MarketTakers/arbiter
6
0
Fork 0
Code Issues 14 Pull Requests 4 Packages Projects Releases Wiki Activity

Compare commits

base: MarketTakers:feat-auto-fix-lints
Branches Tags
MarketTakers:main MarketTakers:terminate-VaultGate-connection-after-vault-lockout MarketTakers:hashable-integrable-macro MarketTakers:zeroized-bootstrap-token MarketTakers:push-zvwxtnqkumlx MarketTakers:feat-auto-fix-lints MarketTakers:feat-shamir MarketTakers:enforcing-integrity MarketTakers:push-wxnlsulvnrpz MarketTakers:check-uac-cerf MarketTakers:impl-useragent_delete_grant MarketTakers:Client-key-replacement-attack MarketTakers:critical-fix-CI-check-all-features MarketTakers:win-service MarketTakers:fix-proto-build-script MarketTakers:terrors-refactor MarketTakers:PoC-terrors MarketTakers:push-lspnytwuyulm MarketTakers:key-alternative MarketTakers:push-yyxvkwvyspxv MarketTakers:security-breaktrougth
..
compare: MarketTakers:impl-useragent_delete_grant
Branches Tags
MarketTakers:terminate-VaultGate-connection-after-vault-lockout MarketTakers:hashable-integrable-macro MarketTakers:main MarketTakers:zeroized-bootstrap-token MarketTakers:push-zvwxtnqkumlx MarketTakers:feat-auto-fix-lints MarketTakers:feat-shamir MarketTakers:enforcing-integrity MarketTakers:push-wxnlsulvnrpz MarketTakers:check-uac-cerf MarketTakers:impl-useragent_delete_grant MarketTakers:Client-key-replacement-attack MarketTakers:critical-fix-CI-check-all-features MarketTakers:win-service MarketTakers:fix-proto-build-script MarketTakers:terrors-refactor MarketTakers:PoC-terrors MarketTakers:push-lspnytwuyulm MarketTakers:key-alternative MarketTakers:push-yyxvkwvyspxv MarketTakers:security-breaktrougth

1 Commits
feat-auto- ... impl-usera

Author SHA1 Message Date
CleverWild
3aae3e1d83 feat(server): implement useragent_delete_grant hard delete cleanup
Some checks failed
ci/woodpecker/pr/server-audit Pipeline was successful
Details
ci/woodpecker/pr/server-vet Pipeline failed
Details
ci/woodpecker/pr/server-lint Pipeline failed
Details
ci/woodpecker/pr/server-test Pipeline was successful
Details
2026-04-05 17:52:44 +02:00
438 changed files with 66686 additions and 79247 deletions
Expand all files Collapse all files

22
.claude/memory/feedback_widget_decomposition.md
View File

@@ -1,11 +1,11 @@
--- ---
name: Widget decomposition and provider subscriptions name: Widget decomposition and provider subscriptions
description: Prefer splitting screens into multiple focused files/widgets; each widget subscribes to its own relevant providers description: Prefer splitting screens into multiple focused files/widgets; each widget subscribes to its own relevant providers
type: feedback type: feedback
--- ---
Split screens into multiple smaller widgets across multiple files. Each widget should subscribe only to the providers it needs (`ref.watch` at lowest possible level), rather than having one large screen widget that watches everything and passes data down as parameters. Split screens into multiple smaller widgets across multiple files. Each widget should subscribe only to the providers it needs (`ref.watch` at lowest possible level), rather than having one large screen widget that watches everything and passes data down as parameters.
**Why:** Reduces unnecessary rebuilds; improves readability; each file has one clear responsibility. **Why:** Reduces unnecessary rebuilds; improves readability; each file has one clear responsibility.
**How to apply:** When building a new screen, identify which sub-widgets need their own provider subscriptions and extract them into separate files (e.g., `widgets/grant_card.dart` watches enrichment providers itself, rather than the screen doing it and passing resolved strings down). **How to apply:** When building a new screen, identify which sub-widgets need their own provider subscriptions and extract them into separate files (e.g., `widgets/grant_card.dart` watches enrichment providers itself, rather than the screen doing it and passing resolved strings down).

12
.gitignore vendored
View File

@@ -1,6 +1,6 @@
target/ target/
scripts/__pycache__/ scripts/__pycache__/
.DS_Store .DS_Store
.cargo/config.toml .cargo/config.toml
.vscode/ .vscode/
docs/superpowers docs/

50
.woodpecker/server-audit.yaml
View File

@@ -1,26 +1,26 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
steps: steps:
- name: audit - name: audit
image: jdxcode/mise:latest image: jdxcode/mise:latest
directory: server directory: server
environment: environment:
CARGO_TERM_COLOR: always CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry CARGO_HOME: /usr/local/cargo/registry
volumes: volumes:
- cargo-target:/usr/local/cargo/target - cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry - cargo-registry:/usr/local/cargo/registry
commands: commands:
- apt-get update && apt-get install -y pkg-config - apt-get update && apt-get install -y pkg-config
# Install only the necessary Rust toolchain and test runner to speed up the CI # Install only the necessary Rust toolchain and test runner to speed up the CI
- mise install rust - mise install rust
- mise install cargo:cargo-audit - mise install cargo:cargo-audit
- mise exec cargo:cargo-audit -- cargo audit - mise exec cargo:cargo-audit -- cargo audit

45
.woodpecker/server-clippy-fix.yaml
View File

@@ -1,45 +0,0 @@
when:
- event: push
branch: main
path:
include: ['.woodpecker/server-*.yaml', 'server/**']
steps:
- name: clippy-fix
image: jdxcode/mise:latest
directory: server
environment:
CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry
GITEA_TOKEN:
from_secret: GITEA_TOKEN
GITEA_URL:
from_secret: GITEA_URL
volumes:
- cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry
commands:
- apt-get update && apt-get install -y pkg-config curl
- mise install rust
- mise install protoc
- mise exec rust -- cargo clippy --fix --allow-dirty --all
- |
cd ..
if git diff --quiet HEAD; then
echo "No machine-applicable clippy fixes found, nothing to do."
exit 0
fi
git config user.email "bot@arbiter"
git config user.name "Clippy Bot"
git add -A
git commit -m "fix(clippy): apply auto-fixable linting suggestions"
git config http.extraHeader "Authorization: token ${GITEA_TOKEN}"
git push --force origin HEAD:refs/heads/bot/clippy-fixes
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
-X POST "${GITEA_URL}/api/v1/repos/${CI_REPO}/pulls" \
-H "Authorization: token ${GITEA_TOKEN}" \
-H "Content-Type: application/json" \
-d "{\"title\":\"fix(clippy): apply auto-fixable linting suggestions\",\"head\":\"bot/clippy-fixes\",\"base\":\"main\",\"body\":\"Automated clippy fixes generated by CI bot.\"}")
echo "Gitea API response: ${HTTP_STATUS}"
[ "$HTTP_STATUS" = "201" ] || [ "$HTTP_STATUS" = "409" ] || [ "$HTTP_STATUS" = "422" ] || exit 1

48
.woodpecker/server-lint.yaml
View File

@@ -1,25 +1,25 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
steps: steps:
- name: lint - name: lint
image: jdxcode/mise:latest image: jdxcode/mise:latest
directory: server directory: server
environment: environment:
CARGO_TERM_COLOR: always CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry CARGO_HOME: /usr/local/cargo/registry
volumes: volumes:
- cargo-target:/usr/local/cargo/target - cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry - cargo-registry:/usr/local/cargo/registry
commands: commands:
- apt-get update && apt-get install -y pkg-config - apt-get update && apt-get install -y pkg-config
- mise install rust - mise install rust
- mise install protoc - mise install protoc
- mise exec rust -- cargo clippy --all -- -D warnings - mise exec rust -- cargo clippy --all -- -D warnings

52
.woodpecker/server-test.yaml
View File

@@ -1,27 +1,27 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
steps: steps:
- name: test - name: test
image: jdxcode/mise:latest image: jdxcode/mise:latest
directory: server directory: server
environment: environment:
CARGO_TERM_COLOR: always CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry CARGO_HOME: /usr/local/cargo/registry
volumes: volumes:
- cargo-target:/usr/local/cargo/target - cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry - cargo-registry:/usr/local/cargo/registry
commands: commands:
- apt-get update && apt-get install -y pkg-config - apt-get update && apt-get install -y pkg-config
# Install only the necessary Rust toolchain and test runner to speed up the CI # Install only the necessary Rust toolchain and test runner to speed up the CI
- mise install rust - mise install rust
- mise install protoc - mise install protoc
- mise install cargo:cargo-nextest - mise install cargo:cargo-nextest
- mise exec cargo:cargo-nextest -- cargo nextest run --no-fail-fast --all-features - mise exec cargo:cargo-nextest -- cargo nextest run --no-fail-fast --all-features

50
.woodpecker/server-vet.yaml
View File

@@ -1,26 +1,26 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
steps: steps:
- name: vet - name: vet
image: jdxcode/mise:latest image: jdxcode/mise:latest
directory: server directory: server
environment: environment:
CARGO_TERM_COLOR: always CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry CARGO_HOME: /usr/local/cargo/registry
volumes: volumes:
- cargo-target:/usr/local/cargo/target - cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry - cargo-registry:/usr/local/cargo/registry
commands: commands:
- apt-get update && apt-get install -y pkg-config - apt-get update && apt-get install -y pkg-config
# Install only the necessary Rust toolchain and test runner to speed up the CI # Install only the necessary Rust toolchain and test runner to speed up the CI
- mise install rust - mise install rust
- mise install cargo:cargo-vet - mise install cargo:cargo-vet
- mise exec cargo:cargo-vet -- cargo vet - mise exec cargo:cargo-vet -- cargo vet

34
.woodpecker/useragent-analyze.yaml
View File

@@ -1,18 +1,18 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/useragent-*.yaml', 'useragent/**'] include: ['.woodpecker/useragent-*.yaml', 'useragent/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/useragent-*.yaml', 'useragent/**'] include: ['.woodpecker/useragent-*.yaml', 'useragent/**']
steps: steps:
- name: analyze - name: analyze
image: jdxcode/mise:latest image: jdxcode/mise:latest
commands: commands:
- mise install flutter - mise install flutter
- mise install protoc - mise install protoc
# Reruns codegen to catch protocol drift # Reruns codegen to catch protocol drift
- mise codegen - mise codegen
- cd useragent/ && flutter analyze - cd useragent/ && flutter analyze

277
AGENTS.md
View File

@@ -1,149 +1,128 @@
# AGENTS.md # AGENTS.md
This file provides guidance to Codex (Codex.ai/code) when working with code in this repository. This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
## Project Overview ## Project Overview
Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of: Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies - **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
- **`operator/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf - **`useragent/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
- **`protobufs/`** — Protocol Buffer definitions shared between server and client - **`protobufs/`** — Protocol Buffer definitions shared between server and client
The vault never exposes key material; it only produces signatures when requests satisfy configured policies. The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
## Toolchain Setup ## Toolchain Setup
Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools: Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
```sh ```sh
mise install mise install
``` ```
Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite). Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
## Server (Rust workspace at `server/`) ## Server (Rust workspace at `server/`)
### Crates ### Crates
| Crate | Purpose | | Crate | Purpose |
|---|---| |---|---|
| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` | | `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation | | `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
| `arbiter-operator` | Rust client library for the operator side of the gRPC protocol | | `arbiter-useragent` | Rust client library for the user agent side of the gRPC protocol |
| `arbiter-client` | Rust client library for SDK clients | | `arbiter-client` | Rust client library for SDK clients |
### Common Commands ### Common Commands
```sh ```sh
cd server cd server
# Build # Build
cargo build cargo build
# Run the server daemon # Run the server daemon
cargo run -p arbiter-server cargo run -p arbiter-server
# Run all tests (preferred over cargo test) # Run all tests (preferred over cargo test)
cargo nextest run cargo nextest run
# Run a single test # Run a single test
cargo nextest run <test_name> cargo nextest run <test_name>
# Lint # Lint
cargo clippy cargo clippy
# Security audit # Security audit
cargo audit cargo audit
# Check unused dependencies # Check unused dependencies
cargo shear cargo shear
# Run snapshot tests and update snapshots # Run snapshot tests and update snapshots
cargo insta review cargo insta review
``` ```
### Architecture ### Architecture
The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`: The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run. - **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
- **`Vault`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell. - **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
- **`FlowCoordinator`** — Coordinates cross-connection flow between operators and SDK clients. - **`FlowCoordinator`** — Coordinates cross-connection flow between user agents and SDK clients.
- **`EvmActor`** — Handles EVM transaction policy enforcement and signing. - **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
Per-connection actors live under `actors/operator/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules. Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`. **Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
**Cryptography:** **Cryptography:**
- Authentication: ed25519 (challenge-response, nonce-tracked per peer) - Authentication: ed25519 (challenge-response, nonce-tracked per peer)
- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal) - Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
- Password KDF: Argon2 - Password KDF: Argon2
- Unseal transport: X25519 ephemeral key exchange - Unseal transport: X25519 ephemeral key exchange
- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl` - TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run). **Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
### Proto Regeneration ### Proto Regeneration
When `.proto` files in `protobufs/` change, rebuild to regenerate: When `.proto` files in `protobufs/` change, rebuild to regenerate:
```sh ```sh
cd server && cargo build -p arbiter-proto cd server && cargo build -p arbiter-proto
``` ```
### Database Migrations ### Database Migrations
```sh ```sh
# Create a new migration # Create a new migration
diesel migration generate <name> --migration-dir crates/arbiter-server/migrations diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
# Run migrations manually (server also runs them on startup) # Run migrations manually (server also runs them on startup)
diesel migration run --migration-dir crates/arbiter-server/migrations diesel migration run --migration-dir crates/arbiter-server/migrations
``` ```
### Code Conventions ## User Agent (Flutter + Rinf at `useragent/`)
**`#[must_use]` Attribute:** The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
Apply the `#[must_use]` attribute to return types of functions where the return value is critical and should not be accidentally ignored. This is commonly used for:
Communication between Dart and Rust uses typed **signals** defined in `useragent/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
- Methods that return `bool` indicating success/failure or validation state
- Any function where ignoring the return value indicates a logic error ```sh
cd useragent && rinf gen
Do not apply `#[must_use]` redundantly to items (types or functions) that are already annotated with `#[must_use]`. ```
Example: ### Common Commands
```rust ```sh
#[must_use] cd useragent
pub fn verify(&self, nonce: i32, context: &[u8], signature: &Signature) -> bool {
// verification logic # Run the app (macOS or Windows)
} flutter run
```
# Regenerate Rust↔Dart signal bindings
This forces callers to either use the return value or explicitly ignore it with `let _ = ...;`, preventing silent failures. rinf gen
## Operator (Flutter + Rinf at `operator/`) # Analyze Dart code
flutter analyze
The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `operator/native/hub/` as a separate crate that uses `arbiter-operator` for the gRPC client. ```
Communication between Dart and Rust uses typed **signals** defined in `operator/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings: The Rinf Rust entry point is `useragent/native/hub/src/lib.rs`. It spawns actors defined in `useragent/native/hub/src/actors/` which handle Dart↔server communication via signals.
```sh
cd operator && rinf gen
```
### Common Commands
```sh
cd operator
# Run the app (macOS or Windows)
flutter run
# Regenerate Rust↔Dart signal bindings
rinf gen
# Analyze Dart code
flutter analyze
```
The Rinf Rust entry point is `operator/native/hub/src/lib.rs`. It spawns actors defined in `operator/native/hub/src/actors/` which handle Dart↔server communication via signals.

666
docs/ARCHITECTURE.md → ARCHITECTURE.md
View File

@@ -1,334 +1,332 @@
# Arbiter # Arbiter
Arbiter is a permissioned signing service for cryptocurrency wallets. It runs as a background service on the user's machine with an optional client application for vault management. Arbiter is a permissioned signing service for cryptocurrency wallets. It runs as a background service on the user's machine with an optional client application for vault management.
**Core principle:** The vault NEVER exposes key material. It only produces signatures when a request satisfies the configured policies. **Core principle:** The vault NEVER exposes key material. It only produces signatures when a request satisfies the configured policies.
--- ---
## 1. Peer Types ## 1. Peer Types
Arbiter distinguishes two kinds of peers: Arbiter distinguishes two kinds of peers:
- **Operator** — A client application used by the owner to manage the vault (create wallets, approve SDK clients, configure policies). - **User Agent** — A client application used by the owner to manage the vault (create wallets, approve SDK clients, configure policies).
- **SDK Client** — A consumer of signing capabilities, typically an automation tool. In the future, this could include a browser-based wallet. - **SDK Client** — A consumer of signing capabilities, typically an automation tool. In the future, this could include a browser-based wallet.
- **Recovery Operator** — A dormant recovery participant with narrowly scoped authority used only for custody recovery and operator replacement. - **Recovery Operator** — A dormant recovery participant with narrowly scoped authority used only for custody recovery and operator replacement.
--- ---
## 2. Authentication ## 2. Authentication
### 2.1 Challenge-Response ### 2.1 Challenge-Response
All peers authenticate via public-key cryptography using a challenge-response protocol: All peers authenticate via public-key cryptography using a challenge-response protocol:
1. The peer sends its public key and requests a challenge. 1. The peer sends its public key and requests a challenge.
2. The server looks up the key in its database. If found, it generates a fresh challenge from random bytes plus the current timestamp. 2. The server looks up the key in its database. If found, it increments the nonce and returns a challenge (replay-attack protection).
3. The peer signs the canonical challenge payload with its private key and sends the signature back. 3. The peer signs the challenge with its private key and sends the signature back.
4. The server verifies the signature: 4. The server verifies the signature:
- **Pass:** The connection is considered authenticated. - **Pass:** The connection is considered authenticated.
- **Fail:** The server closes the connection. - **Fail:** The server closes the connection.
Authentication challenges are per-connection, ephemeral values. They are not persisted in the peer tables, and peer records store no challenge state. ### 2.2 User Agent Bootstrap
### 2.2 Operator Bootstrap On first run — when no User Agents are registered — the server generates a one-time bootstrap token. It is made available in two ways:
On first run — when no Operators are registered — the server generates a one-time bootstrap token. It is made available in two ways: - **Local setup:** Written to `~/.arbiter/bootstrap_token` for automatic discovery by a co-located User Agent.
- **Remote setup:** Printed to the server's console output.
- **Local setup:** Written to `~/.arbiter/bootstrap_token` for automatic discovery by a co-located Operator.
- **Remote setup:** Printed to the server's console output. The first User Agent must present this token alongside the standard challenge-response to complete registration.
The first Operator must present this token alongside the standard challenge-response to complete registration. ### 2.3 SDK Client Registration
### 2.3 SDK Client Registration There is no bootstrap mechanism for SDK clients. They must be explicitly approved by an already-registered User Agent.
There is no bootstrap mechanism for SDK clients. They must be explicitly approved by an already-registered Operator. ---
--- ## 3. Multi-Operator Governance
## 3. Multi-Operator Governance When more than one User Agent is registered, the vault is treated as having multiple operators. In that mode, sensitive actions are governed by voting rather than by a single operator decision.
When more than one Operator is registered, the vault is treated as having multiple operators. In that mode, sensitive actions are governed by voting rather than by a single operator decision. ### 3.1 Voting Rules
### 3.1 Voting Rules Voting is based on the total number of registered operators:
Voting is based on the total number of registered operators: - **1 operator:** no vote is needed; the single operator decides directly.
- **2 operators:** full consensus is required; both operators must approve.
- **1 operator:** no vote is needed; the single operator decides directly. - **3 or more operators:** quorum is `floor(N / 2) + 1`.
- **2 operators:** full consensus is required; both operators must approve.
- **3 or more operators:** quorum is `floor(N / 2) + 1`. For a decision to count, the operator's approval or rejection must be signed by that operator's associated key. Unsigned votes, or votes that fail signature verification, are ignored.
For a decision to count, the operator's approval or rejection must be signed by that operator's associated key. Unsigned votes, or votes that fail signature verification, are ignored. Examples:
Examples: - **3 operators:** 2 approvals required
- **4 operators:** 3 approvals required
- **3 operators:** 2 approvals required
- **4 operators:** 3 approvals required ### 3.2 Actions Requiring a Vote
### 3.2 Actions Requiring a Vote In multi-operator mode, a successful vote is required for:
In multi-operator mode, a successful vote is required for: - approving new SDK clients
- granting an SDK client visibility to a wallet
- approving new SDK clients - approving a one-off transaction
- granting an SDK client visibility to a wallet - approving creation of a persistent grant
- approving a one-off transaction - approving operator replacement
- approving creation of a persistent grant - approving server updates
- approving operator replacement - updating Shamir secret-sharing parameters
- approving server updates
- updating Shamir secret-sharing parameters ### 3.3 Special Rule for Key Rotation
### 3.3 Special Rule for Key Rotation Key rotation always requires full quorum, regardless of the normal voting threshold.
Key rotation always requires full quorum, regardless of the normal voting threshold. This is stricter than ordinary governance actions because rotating the root key requires every operator to participate in coordinated share refresh/update steps. The root key itself is not redistributed directly, but each operator's share material must be changed consistently.
This is stricter than ordinary governance actions because rotating the root key requires every operator to participate in coordinated share refresh/update steps. The root key itself is not redistributed directly, but each operator's share material must be changed consistently. ### 3.4 Root Key Custody
### 3.4 Root Key Custody When the vault has multiple operators, the vault root key is protected using Shamir secret sharing.
When the vault has multiple operators, the vault root key is protected using Shamir secret sharing. The vault root key is encrypted in a way that requires reconstruction from user-held shares rather than from a single shared password.
The vault root key is encrypted in a way that requires reconstruction from user-held shares rather than from a single shared password. For ordinary operators, the Shamir threshold matches the ordinary governance quorum. For example:
For ordinary operators, the Shamir threshold matches the ordinary governance quorum. For example: - **2 operators:** `2-of-2`
- **3 operators:** `2-of-3`
- **2 operators:** `2-of-2` - **4 operators:** `3-of-4`
- **3 operators:** `2-of-3`
- **4 operators:** `3-of-4` In practice, the Shamir share set also includes Recovery Operator shares. This means the effective Shamir parameters are computed over the combined share pool while keeping the same threshold. For example:
In practice, the Shamir share set also includes Recovery Operator shares. This means the effective Shamir parameters are computed over the combined share pool while keeping the same threshold. For example: - **3 ordinary operators + 2 recovery shares:** `2-of-5`
- **3 ordinary operators + 2 recovery shares:** `2-of-5` This ensures that the normal custody threshold follows the ordinary operator quorum, while still allowing dormant recovery shares to exist for break-glass recovery flows.
This ensures that the normal custody threshold follows the ordinary operator quorum, while still allowing dormant recovery shares to exist for break-glass recovery flows. ### 3.5 Recovery Operators
### 3.5 Recovery Operators Recovery Operators are a separate peer type from ordinary vault operators.
Recovery Operators are a separate peer type from ordinary vault operators. Their role is intentionally narrow. They can only:
Their role is intentionally narrow. They can only: - participate in unsealing the vault
- vote for operator replacement
- participate in unsealing the vault
- vote for operator replacement Recovery Operators do not participate in routine governance such as approving SDK clients, granting wallet visibility, approving transactions, creating grants, approving server updates, or changing Shamir parameters.
Recovery Operators do not participate in routine governance such as approving SDK clients, granting wallet visibility, approving transactions, creating grants, approving server updates, or changing Shamir parameters. ### 3.6 Sleeping and Waking Recovery Operators
### 3.6 Sleeping and Waking Recovery Operators By default, Recovery Operators are **sleeping** and do not participate in any active flow.
By default, Recovery Operators are **sleeping** and do not participate in any active flow. Any ordinary operator may request that Recovery Operators **wake up**.
Any ordinary operator may request that Recovery Operators **wake up**. Any ordinary operator may also cancel a pending wake-up request.
Any ordinary operator may also cancel a pending wake-up request. This creates a dispute window before recovery powers become active. The default wake-up delay is **14 days**.
This creates a dispute window before recovery powers become active. The default wake-up delay is **14 days**. Recovery Operators are therefore part of the break-glass recovery path rather than the normal operating quorum.
Recovery Operators are therefore part of the break-glass recovery path rather than the normal operating quorum. The high-level recovery flow is:
The high-level recovery flow is: ```mermaid
sequenceDiagram
```mermaid autonumber
sequenceDiagram actor Op as Ordinary Operator
autonumber participant Server
actor Op as Ordinary Operator actor Other as Other Operator
participant Server actor Rec as Recovery Operator
actor Other as Other Operator
actor Rec as Recovery Operator Op->>Server: Request recovery wake-up
Server-->>Op: Wake-up pending
Op->>Server: Request recovery wake-up Note over Server: Default dispute window: 14 days
Server-->>Op: Wake-up pending
Note over Server: Default dispute window: 14 days alt Wake-up cancelled during dispute window
Other->>Server: Cancel wake-up
alt Wake-up cancelled during dispute window Server-->>Op: Recovery cancelled
Other->>Server: Cancel wake-up Server-->>Rec: Stay sleeping
Server-->>Op: Recovery cancelled else No cancellation for 14 days
Server-->>Rec: Stay sleeping Server-->>Rec: Wake up
else No cancellation for 14 days Rec->>Server: Join recovery flow
Server-->>Rec: Wake up critical Recovery authority
Rec->>Server: Join recovery flow Rec->>Server: Participate in unseal
critical Recovery authority Rec->>Server: Vote on operator replacement
Rec->>Server: Participate in unseal end
Rec->>Server: Vote on operator replacement Server-->>Op: Recovery mode active
end end
Server-->>Op: Recovery mode active ```
end
``` ### 3.7 Committee Formation
### 3.7 Committee Formation There are two ways to form a multi-operator committee:
There are two ways to form a multi-operator committee: - convert an existing single-operator vault by adding new operators
- bootstrap an unbootstrapped vault directly into multi-operator mode
- convert an existing single-operator vault by adding new operators
- bootstrap an unbootstrapped vault directly into multi-operator mode In both cases, committee formation is a coordinated process. Arbiter does not allow multi-operator custody to emerge implicitly from unrelated registrations.
In both cases, committee formation is a coordinated process. Arbiter does not allow multi-operator custody to emerge implicitly from unrelated registrations. ### 3.8 Bootstrapping an Unbootstrapped Vault into Multi-Operator Mode
### 3.8 Bootstrapping an Unbootstrapped Vault into Multi-Operator Mode When an unbootstrapped vault is initialized as a multi-operator vault, the setup proceeds as follows:
When an unbootstrapped vault is initialized as a multi-operator vault, the setup proceeds as follows: 1. An operator connects to the unbootstrapped vault using a User Agent and the bootstrap token.
2. During bootstrap setup, that operator declares:
1. An operator connects to the unbootstrapped vault using an Operator and the bootstrap token. - the total number of ordinary operators
2. During bootstrap setup, that operator declares: - the total number of Recovery Operators
- the total number of ordinary operators 3. The vault enters **multi-bootstrap mode**.
- the total number of Recovery Operators 4. While in multi-bootstrap mode:
3. The vault enters **multi-bootstrap mode**. - every ordinary operator must connect with a User Agent using the bootstrap token
4. While in multi-bootstrap mode: - every Recovery Operator must also connect using the bootstrap token
- every ordinary operator must connect with an Operator using the bootstrap token - each participant is registered individually
- every Recovery Operator must also connect using the bootstrap token - each participant's share is created and protected with that participant's credentials
- each participant is registered individually 5. The vault is considered fully bootstrapped only after all declared operator and recovery-share registrations have completed successfully.
- each participant's share is created and protected with that participant's credentials
5. The vault is considered fully bootstrapped only after all declared operator and recovery-share registrations have completed successfully. This means the operator and recovery set is fixed at bootstrap completion time, based on the counts declared when multi-bootstrap mode was entered.
This means the operator and recovery set is fixed at bootstrap completion time, based on the counts declared when multi-bootstrap mode was entered. ### 3.9 Special Bootstrap Constraint for Two-Operator Vaults
### 3.9 Special Bootstrap Constraint for Two-Operator Vaults If a vault is declared with exactly **2 ordinary operators**, Arbiter requires at least **1 Recovery Operator** to be configured during bootstrap.
If a vault is declared with exactly **2 ordinary operators**, Arbiter requires at least **1 Recovery Operator** to be configured during bootstrap. This prevents the worst-case custody failure in which a `2-of-2` operator set becomes permanently unrecoverable after loss of a single operator.
This prevents the worst-case custody failure in which a `2-of-2` operator set becomes permanently unrecoverable after loss of a single operator. ---
--- ## 4. Server Identity
## 4. Server Identity The server proves its identity using TLS with a self-signed certificate. The TLS private key is generated on first run and is long-term; no rotation mechanism exists yet due to the complexity of multi-peer coordination.
The server proves its identity using TLS with a self-signed certificate. The TLS private key is generated on first run and is long-term; no rotation mechanism exists yet due to the complexity of multi-peer coordination. Peers verify the server by its **public key fingerprint**:
Peers verify the server by its **public key fingerprint**: - **User Agent (local):** Receives the fingerprint automatically through the bootstrap token.
- **User Agent (remote) / SDK Client:** Must receive the fingerprint out-of-band.
- **Operator (local):** Receives the fingerprint automatically through the bootstrap token.
- **Operator (remote) / SDK Client:** Must receive the fingerprint out-of-band. > A streamlined setup mechanism using a single connection string is planned but not yet implemented.
> A streamlined setup mechanism using a single connection string is planned but not yet implemented. ---
--- ## 5. Key Management
## 5. Key Management ### 5.1 Key Hierarchy
### 5.1 Key Hierarchy There are three layers of keys:
There are three layers of keys: | Key | Encrypts | Encrypted by |
|---|---|---|
| Key | Encrypts | Encrypted by | | **User key** (password) | Root key | — (derived from user input) |
|---|---|---| | **Root key** | Wallet keys | User key |
| **User key** (password) | Root key | — (derived from user input) | | **Wallet keys** | — (used for signing) | Root key |
| **Root key** | Wallet keys | User key |
| **Wallet keys** | — (used for signing) | Root key | This layered design enables:
This layered design enables: - **Password rotation** without re-encrypting every wallet key (only the root key is re-encrypted).
- **Root key rotation** without requiring the user to change their password.
- **Password rotation** without re-encrypting every wallet key (only the root key is re-encrypted).
- **Root key rotation** without requiring the user to change their password. ### 5.2 Encryption at Rest
### 5.2 Encryption at Rest The database stores everything in encrypted form using symmetric AEAD. The encryption scheme is versioned to support transparent migration — when the vault unseals, Arbiter automatically re-encrypts any entries that are behind the current scheme version. See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the specific scheme and versioning mechanism.
The database stores everything in encrypted form using symmetric AEAD. The encryption scheme is versioned to support transparent migration — when the vault unseals, Arbiter automatically re-encrypts any entries that are behind the current scheme version. See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the specific scheme and versioning mechanism. ---
--- ## 6. Vault Lifecycle
## 6. Vault Lifecycle ### 6.1 Sealed State
### 6.1 Sealed State On boot, the root key is encrypted and the server cannot perform any signing operations. This state is called **Sealed**.
On boot, the root key is encrypted and the server cannot perform any signing operations. This state is called **Sealed**. ### 6.2 Unseal Flow
### 6.2 Unseal Flow To transition to the **Unsealed** state, a User Agent must provide the password:
To transition to the **Unsealed** state, an Operator must provide the password: 1. The User Agent initiates an unseal request.
2. The server generates a one-time key pair and returns the public key.
1. The Operator initiates an unseal request. 3. The User Agent encrypts the user's password with this one-time public key and sends the ciphertext to the server.
2. The server generates a one-time key pair and returns the public key. 4. The server decrypts and verifies the password:
3. The Operator encrypts the user's password with this one-time public key and sends the ciphertext to the server. - **Success:** The root key is decrypted and placed into a hardened memory cell. The server transitions to `Unsealed`. Any entries pending encryption scheme migration are re-encrypted.
4. The server decrypts and verifies the password: - **Failure:** The server returns an error indicating the password is incorrect.
- **Success:** The root key is decrypted and placed into a hardened memory cell. The server transitions to `Unsealed`. Any entries pending encryption scheme migration are re-encrypted.
- **Failure:** The server returns an error indicating the password is incorrect. ### 6.3 Memory Protection
### 6.3 Memory Protection Once unsealed, the root key must be protected in memory against:
Once unsealed, the root key must be protected in memory against: - Memory dumps
- Page swaps to disk
- Memory dumps - Hibernation files
- Page swaps to disk
- Hibernation files See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the current and planned memory protection approaches.
See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the current and planned memory protection approaches. ---
--- ## 7. Permission Engine
## 7. Permission Engine ### 7.1 Fundamental Rules
### 7.1 Fundamental Rules - SDK clients have **no access by default**.
- Access is granted **explicitly** by a User Agent.
- SDK clients have **no access by default**. - Grants are scoped to **specific wallets** and governed by **policies**.
- Access is granted **explicitly** by an Operator.
- Grants are scoped to **specific wallets** and governed by **policies**. Each blockchain requires its own policy system due to differences in static transaction analysis. Currently, only EVM is supported; Solana support is planned.
Each blockchain requires its own policy system due to differences in static transaction analysis. Currently, only EVM is supported; Solana support is planned. Arbiter is also responsible for ensuring that **transaction nonces are never reused**.
Arbiter is also responsible for ensuring that **transaction nonces are never reused**. ### 7.2 EVM Policies
### 7.2 EVM Policies Every EVM grant is scoped to a specific **wallet** and **chain ID**.
Every EVM grant is scoped to a specific **wallet** and **chain ID**. #### 7.2.0 Transaction Signing Sequence
#### 7.2.0 Transaction Signing Sequence The high-level interaction order is:
The high-level interaction order is: ```mermaid
sequenceDiagram
```mermaid autonumber
sequenceDiagram actor SDK as SDK Client
autonumber participant Server
actor SDK as SDK Client participant UA as User Agent
participant Server
participant operator as Operator SDK->>Server: SignTransactionRequest
Server->>Server: Resolve wallet and wallet visibility
SDK->>Server: SignTransactionRequest alt Visibility approval required
Server->>Server: Resolve wallet and wallet visibility Server->>UA: Ask for wallet visibility approval
alt Visibility approval required UA-->>Server: Vote result
Server->>operator: Ask for wallet visibility approval end
operator-->>Server: Vote result Server->>Server: Evaluate transaction
end Server->>Server: Load grant and limits context
Server->>Server: Evaluate transaction alt Grant approval required
Server->>Server: Load grant and limits context Server->>UA: Ask for execution / grant approval
alt Grant approval required UA-->>Server: Vote result
Server->>operator: Ask for execution / grant approval opt Create persistent grant
operator-->>Server: Vote result Server->>Server: Create and store grant
opt Create persistent grant end
Server->>Server: Create and store grant Server->>Server: Retry evaluation
end end
Server->>Server: Retry evaluation critical Final authorization path
end Server->>Server: Check limits and record execution
critical Final authorization path Server-->>Server: Signature or evaluation error
Server->>Server: Check limits and record execution end
Server-->>Server: Signature or evaluation error Server-->>SDK: Signature or error
end ```
Server-->>SDK: Signature or error
``` #### 7.2.1 Transaction Sub-Grants
#### 7.2.1 Transaction Sub-Grants Arbiter maintains an ever-expanding database of known contracts and their ABIs. Based on contract knowledge, transaction requests fall into three categories:
Arbiter maintains an ever-expanding database of known contracts and their ABIs. Based on contract knowledge, transaction requests fall into three categories: **1. Known contract (ABI available)**
**1. Known contract (ABI available)** The transaction can be decoded and presented with semantic meaning. For example: *"Client X wants to transfer Y USDT to address Z."*
The transaction can be decoded and presented with semantic meaning. For example: *"Client X wants to transfer Y USDT to address Z."* Available restrictions:
- Volume limits (e.g., "no more than 10,000 tokens ever")
Available restrictions: - Rate limits (e.g., "no more than 100 tokens per hour")
- Volume limits (e.g., "no more than 10,000 tokens ever")
- Rate limits (e.g., "no more than 100 tokens per hour") **2. Unknown contract (no ABI)**
**2. Unknown contract (no ABI)** The transaction cannot be decoded, so its effects are opaque — it could do anything, including draining all tokens. The user is warned, and if approved, access is granted to all interactions with the contract (matched by the `to` field).
The transaction cannot be decoded, so its effects are opaque — it could do anything, including draining all tokens. The user is warned, and if approved, access is granted to all interactions with the contract (matched by the `to` field). Available restrictions:
- Transaction count limits (e.g., "no more than 100 transactions ever")
Available restrictions: - Rate limits (e.g., "no more than 5 transactions per hour")
- Transaction count limits (e.g., "no more than 100 transactions ever")
- Rate limits (e.g., "no more than 5 transactions per hour") **3. Plain ether transfer (no calldata)**
**3. Plain ether transfer (no calldata)** These transactions have no `calldata` and therefore cannot interact with contracts. They can be subject to the same volume and rate restrictions as above.
These transactions have no `calldata` and therefore cannot interact with contracts. They can be subject to the same volume and rate restrictions as above. #### 7.2.2 Global Limits
#### 7.2.2 Global Limits In addition to sub-grant-specific restrictions, the following limits can be applied across all grant types:
In addition to sub-grant-specific restrictions, the following limits can be applied across all grant types: - **Gas limit** — Maximum gas per transaction.
- **Time-window restrictions** — e.g., signing allowed only 08:00–20:00 on Mondays and Thursdays.
- **Gas limit** — Maximum gas per transaction.
- **Time-window restrictions** — e.g., signing allowed only 08:00–20:00 on Mondays and Thursdays.

129
CLAUDE.md
View File

@@ -1 +1,128 @@
Refer to @AGENTS.md for instructions. # CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
## Project Overview
Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
- **`useragent/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
- **`protobufs/`** — Protocol Buffer definitions shared between server and client
The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
## Toolchain Setup
Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
```sh
mise install
```
Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
## Server (Rust workspace at `server/`)
### Crates
| Crate | Purpose |
|---|---|
| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
| `arbiter-useragent` | Rust client library for the user agent side of the gRPC protocol |
| `arbiter-client` | Rust client library for SDK clients |
### Common Commands
```sh
cd server
# Build
cargo build
# Run the server daemon
cargo run -p arbiter-server
# Run all tests (preferred over cargo test)
cargo nextest run
# Run a single test
cargo nextest run <test_name>
# Lint
cargo clippy
# Security audit
cargo audit
# Check unused dependencies
cargo shear
# Run snapshot tests and update snapshots
cargo insta review
```
### Architecture
The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
- **`KeyHolder`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
- **`FlowCoordinator`** — Coordinates cross-connection flow between user agents and SDK clients.
- **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
Per-connection actors live under `actors/user_agent/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
**Cryptography:**
- Authentication: ed25519 (challenge-response, nonce-tracked per peer)
- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
- Password KDF: Argon2
- Unseal transport: X25519 ephemeral key exchange
- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
### Proto Regeneration
When `.proto` files in `protobufs/` change, rebuild to regenerate:
```sh
cd server && cargo build -p arbiter-proto
```
### Database Migrations
```sh
# Create a new migration
diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
# Run migrations manually (server also runs them on startup)
diesel migration run --migration-dir crates/arbiter-server/migrations
```
## User Agent (Flutter + Rinf at `useragent/`)
The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `useragent/native/hub/` as a separate crate that uses `arbiter-useragent` for the gRPC client.
Communication between Dart and Rust uses typed **signals** defined in `useragent/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
```sh
cd useragent && rinf gen
```
### Common Commands
```sh
cd useragent
# Run the app (macOS or Windows)
flutter run
# Regenerate Rust↔Dart signal bindings
rinf gen
# Analyze Dart code
flutter analyze
```
The Rinf Rust entry point is `useragent/native/hub/src/lib.rs`. It spawns actors defined in `useragent/native/hub/src/actors/` which handle Dart↔server communication via signals.

465
docs/IMPLEMENTATION.md → IMPLEMENTATION.md
View File

@@ -1,226 +1,239 @@
# Implementation Details # Implementation Details
This document covers concrete technology choices and dependencies. For the architectural design, see [ARCHITECTURE.md](ARCHITECTURE.md). This document covers concrete technology choices and dependencies. For the architectural design, see [ARCHITECTURE.md](ARCHITECTURE.md).
--- ---
## Client Connection Flow ## Client Connection Flow
### Authentication Result Semantics ### Authentication Result Semantics
Authentication no longer uses an implicit success-only response shape. Both `client` and `operator` return explicit auth status enums over the wire. Authentication no longer uses an implicit success-only response shape. Both `client` and `user-agent` return explicit auth status enums over the wire.
- **Client:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `APPROVAL_DENIED`, `NO_OPERATORS_ONLINE`, or `INTERNAL` - **Client:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `APPROVAL_DENIED`, `NO_USER_AGENTS_ONLINE`, or `INTERNAL`
- **Operator:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `BOOTSTRAP_REQUIRED`, `TOKEN_INVALID`, or `INTERNAL` - **User-agent:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `BOOTSTRAP_REQUIRED`, `TOKEN_INVALID`, or `INTERNAL`
This makes transport-level failures and actor/domain-level auth failures distinct: This makes transport-level failures and actor/domain-level auth failures distinct:
- **Transport/protocol failures** are surfaced as stream/status errors - **Transport/protocol failures** are surfaced as stream/status errors
- **Authentication failures** are surfaced as successful protocol responses carrying an explicit auth status - **Authentication failures** are surfaced as successful protocol responses carrying an explicit auth status
Clients are expected to handle these status codes directly and present the concrete failure reason to the user. Clients are expected to handle these status codes directly and present the concrete failure reason to the user.
### New Client Approval ### New Client Approval
When a client whose public key is not yet in the database connects, all connected operators are asked to approve the connection. The first operator to respond determines the outcome; remaining requests are cancelled via a watch channel. When a client whose public key is not yet in the database connects, all connected user agents are asked to approve the connection. The first agent to respond determines the outcome; remaining requests are cancelled via a watch channel.
```mermaid ```mermaid
flowchart TD flowchart TD
A([Client connects]) --> B[Receive AuthChallengeRequest] A([Client connects]) --> B[Receive AuthChallengeRequest]
B --> C{pubkey in DB?} B --> C{pubkey in DB?}
C -- yes --> G[Generate AuthChallenge] C -- yes --> D[Read nonce\nIncrement nonce in DB]
D --> G
C -- no --> E[Ask all Operators:\nClientConnectionRequest]
E --> F{First response} C -- no --> E[Ask all UserAgents:\nClientConnectionRequest]
F -- denied --> Z([Reject connection]) E --> F{First response}
F -- approved --> F2[Cancel remaining\nOperator requests] F -- denied --> Z([Reject connection])
F2 --> F3[INSERT client] F -- approved --> F2[Cancel remaining\nUserAgent requests]
F3 --> G F2 --> F3[INSERT client\nnonce = 1]
F3 --> G[Send AuthChallenge\nwith nonce]
G --> H[Send AuthChallenge\ntimestamp + random bytes]
H --> I[Receive AuthChallengeSolution] G --> H[Receive AuthChallengeSolution]
I --> K{Signature valid?} H --> I{Signature valid?}
K -- no --> Z I -- no --> Z
K -- yes --> J([Session started]) I -- yes --> J([Session started])
``` ```
Auth challenges are generated from fresh random bytes plus a nanosecond timestamp. The server keeps the issued challenge only in the in-flight authentication state for that connection, then verifies the signature against the same canonical challenge payload. ### Known Issue: Concurrent Registration Race (TOCTOU)
The authentication schema stores peer identity, not replay counters: Two connections presenting the same previously-unknown public key can race through the approval flow simultaneously:
- `program_client` stores the SDK client's public key, metadata binding, and timestamps. 1. Both check the DB → neither is registered.
- `operator_client` stores the Operator public key and timestamps. 2. Both request approval from user agents → both receive approval.
- Neither table stores an authentication nonce, and challenge generation does not update either table. 3. Both `INSERT` the client record → the second insert silently overwrites the first, resetting the nonce.
--- This means the first connection's nonce is invalidated by the second, causing its challenge verification to fail. A fix requires either serialising new-client registration (e.g. an in-memory lock keyed on pubkey) or replacing the separate check + insert with an `INSERT OR IGNORE` / upsert guarded by a unique constraint on `public_key`.
## Cryptography ### Nonce Semantics
### Authentication The `program_client.nonce` column stores the **next usable nonce** — i.e. it is always one ahead of the nonce last issued in a challenge.
- **Client protocol:** ML-DSA
- **New client:** inserted with `nonce = 1`; the first challenge is issued with `nonce = 0`.
### User-Agent Authentication - **Existing client:** the current DB value is read and used as the challenge nonce, then immediately incremented within the same exclusive transaction, preventing replay.
Operator authentication supports multiple signature schemes because platform-provided "hardware-bound" keys do not expose a uniform algorithm across operating systems and hardware. ---
- **Supported schemes:** ML-DSA ## Cryptography
- **Why:** Secure Enclave (MacOS) support them natively, on other platforms we could emulate while they roll-out
### Authentication
### Encryption at Rest - **Client protocol:** ed25519
- **Scheme:** Symmetric AEAD — currently **XChaCha20-Poly1305**
- **Version tracking:** Each `aead_encrypted` database entry carries a `scheme` field denoting the version, enabling transparent migration on unseal ### User-Agent Authentication
### Server Identity User-agent authentication supports multiple signature schemes because platform-provided "hardware-bound" keys do not expose a uniform algorithm across operating systems and hardware.
- **Transport:** TLS with a self-signed certificate
- **Key type:** Generated on first run; long-term (no rotation mechanism yet) - **Supported schemes:** RSA, Ed25519, ECDSA (secp256k1)
- **Why:** the user agent authenticates with keys backed by platform facilities, and those facilities differ by platform
--- - **Apple Silicon Secure Enclave / Secure Element:** ECDSA-only in practice
- **Windows Hello / TPM 2.0:** currently RSA-backed in our integration
## Communication
This is why the user-agent auth protocol carries an explicit `KeyType`, while the SDK client protocol remains fixed to ed25519.
- **Protocol:** gRPC with Protocol Buffers
- **Request/response matching:** multiplexed over a single bidirectional stream using per-connection request IDs ### Encryption at Rest
- **Server identity distribution:** `ServerInfo` protobuf struct containing the TLS public key fingerprint - **Scheme:** Symmetric AEAD — currently **XChaCha20-Poly1305**
- **Future consideration:** grpc-web lacks bidirectional stream support, so a browser-based wallet may require protojson over WebSocket - **Version tracking:** Each `aead_encrypted` database entry carries a `scheme` field denoting the version, enabling transparent migration on unseal
### Request Multiplexing ### Server Identity
- **Transport:** TLS with a self-signed certificate
Both `client` and `operator` connections support multiple in-flight requests over one gRPC bidi stream. - **Key type:** Generated on first run; long-term (no rotation mechanism yet)
- Every request carries a monotonically increasing request ID ---
- Every normal response echoes the request ID it corresponds to
- Out-of-band server messages omit the response ID entirely ## Communication
- The server rejects already-seen request IDs at the transport adapter boundary before business logic sees the message
- **Protocol:** gRPC with Protocol Buffers
This keeps request correlation entirely in transport/client connection code while leaving actor and domain handlers unaware of request IDs. - **Request/response matching:** multiplexed over a single bidirectional stream using per-connection request IDs
- **Server identity distribution:** `ServerInfo` protobuf struct containing the TLS public key fingerprint
--- - **Future consideration:** grpc-web lacks bidirectional stream support, so a browser-based wallet may require protojson over WebSocket
## EVM Policy Engine ### Request Multiplexing
### Overview Both `client` and `user-agent` connections support multiple in-flight requests over one gRPC bidi stream.
The EVM engine classifies incoming transactions, enforces grant constraints, and records executions. It is the sole path through which a wallet key is used for signing. - Every request carries a monotonically increasing request ID
- Every normal response echoes the request ID it corresponds to
The central abstraction is the `Policy` trait. Each implementation handles one semantic transaction category and owns its own database tables for grant storage and transaction logging. - Out-of-band server messages omit the response ID entirely
- The server rejects already-seen request IDs at the transport adapter boundary before business logic sees the message
### Transaction Evaluation Flow
This keeps request correlation entirely in transport/client connection code while leaving actor and domain handlers unaware of request IDs.
`Engine::evaluate_transaction` runs the following steps in order:
---
1. **Classify** — Each registered policy's `analyze(context)` inspects the transaction fields (`chain`, `to`, `value`, `calldata`). The first one returning `Some(meaning)` wins. If none match, the transaction is rejected as `UnsupportedTransactionType`.
2. **Find grant** — `Policy::try_find_grant` queries for a non-revoked grant covering this wallet, client, chain, and target address. ## EVM Policy Engine
3. **Check shared constraints** — `check_shared_constraints` runs in the engine before any policy-specific logic. It enforces the validity window, gas fee caps, and transaction count rate limit (see below).
4. **Evaluate** — `Policy::evaluate` checks the decoded meaning against the grant's policy-specific constraints and returns any violations. ### Overview
5. **Record** — If `RunKind::Execution` and there are no violations, the engine writes to `evm_transaction_log` and calls `Policy::record_transaction` for any policy-specific logging (e.g., token transfer volume).
The EVM engine classifies incoming transactions, enforces grant constraints, and records executions. It is the sole path through which a wallet key is used for signing.
The detailed branch structure is shown below:
The central abstraction is the `Policy` trait. Each implementation handles one semantic transaction category and owns its own database tables for grant storage and transaction logging.
```mermaid
flowchart TD ### Transaction Evaluation Flow
A[SDK Client sends sign transaction request] --> B[Server resolves wallet]
B --> C{Wallet exists?} `Engine::evaluate_transaction` runs the following steps in order:
C -- No --> Z1[Return wallet not found error] 1. **Classify** — Each registered policy's `analyze(context)` inspects the transaction fields (`chain`, `to`, `value`, `calldata`). The first one returning `Some(meaning)` wins. If none match, the transaction is rejected as `UnsupportedTransactionType`.
C -- Yes --> D[Check SDK client wallet visibility] 2. **Find grant** — `Policy::try_find_grant` queries for a non-revoked grant covering this wallet, client, chain, and target address.
3. **Check shared constraints** — `check_shared_constraints` runs in the engine before any policy-specific logic. It enforces the validity window, gas fee caps, and transaction count rate limit (see below).
D --> E{Wallet visible to SDK client?} 4. **Evaluate** — `Policy::evaluate` checks the decoded meaning against the grant's policy-specific constraints and returns any violations.
E -- No --> F[Start wallet visibility voting flow] 5. **Record** — If `RunKind::Execution` and there are no violations, the engine writes to `evm_transaction_log` and calls `Policy::record_transaction` for any policy-specific logging (e.g., token transfer volume).
F --> G{Vote approved?}
G -- No --> Z2[Return wallet access denied error] The detailed branch structure is shown below:
G -- Yes --> H[Persist wallet visibility]
E -- Yes --> I[Classify transaction meaning] ```mermaid
H --> I flowchart TD
A[SDK Client sends sign transaction request] --> B[Server resolves wallet]
I --> J{Meaning supported?} B --> C{Wallet exists?}
J -- No --> Z3[Return unsupported transaction error]
J -- Yes --> K[Find matching grant] C -- No --> Z1[Return wallet not found error]
C -- Yes --> D[Check SDK client wallet visibility]
K --> L{Grant exists?}
L -- Yes --> M[Check grant limits] D --> E{Wallet visible to SDK client?}
L -- No --> N[Start execution or grant voting flow] E -- No --> F[Start wallet visibility voting flow]
F --> G{Vote approved?}
N --> O{Operator decision} G -- No --> Z2[Return wallet access denied error]
O -- Reject --> Z4[Return no matching grant error] G -- Yes --> H[Persist wallet visibility]
O -- Allow once --> M E -- Yes --> I[Classify transaction meaning]
O -- Create grant --> P[Create grant with user-selected limits] H --> I
P --> Q[Persist grant]
Q --> M I --> J{Meaning supported?}
J -- No --> Z3[Return unsupported transaction error]
M --> R{Limits exceeded?} J -- Yes --> K[Find matching grant]
R -- Yes --> Z5[Return evaluation error]
R -- No --> S[Record transaction in logs] K --> L{Grant exists?}
S --> T[Produce signature] L -- Yes --> M[Check grant limits]
T --> U[Return signature to SDK client] L -- No --> N[Start execution or grant voting flow]
note1[Limit checks include volume, count, and gas constraints.] N --> O{User-agent decision}
note2[Grant lookup depends on classified meaning, such as ether transfer or token transfer.] O -- Reject --> Z4[Return no matching grant error]
O -- Allow once --> M
K -. uses .-> note2 O -- Create grant --> P[Create grant with user-selected limits]
M -. checks .-> note1 P --> Q[Persist grant]
``` Q --> M
### Policy Trait M --> R{Limits exceeded?}
R -- Yes --> Z5[Return evaluation error]
| Method | Purpose | R -- No --> S[Record transaction in logs]
|---|---| S --> T[Produce signature]
| `analyze` | Pure — classifies a transaction into a typed `Meaning`, or `None` if this policy doesn't apply | T --> U[Return signature to SDK client]
| `evaluate` | Checks the `Meaning` against a `Grant`; returns a list of `EvalViolation`s |
| `create_grant` | Inserts policy-specific rows; returns the specific grant ID | note1[Limit checks include volume, count, and gas constraints.]
| `try_find_grant` | Finds a matching non-revoked grant for the given `EvalContext` | note2[Grant lookup depends on classified meaning, such as ether transfer or token transfer.]
| `find_all_grants` | Returns all non-revoked grants (used for listing) |
| `record_transaction` | Persists policy-specific data after execution | K -. uses .-> note2
M -. checks .-> note1
`analyze` and `evaluate` are intentionally separate: classification is pure and cheap, while evaluation may involve DB queries (e.g., fetching past transfer volume). ```
### Registered Policies ### Policy Trait
**EtherTransfer** — plain ETH transfers (empty calldata) | Method | Purpose |
|---|---|
- Grant requires: allowlist of recipient addresses + one volumetric rate limit (max ETH over a time window) | `analyze` | Pure — classifies a transaction into a typed `Meaning`, or `None` if this policy doesn't apply |
- Violations: recipient not in allowlist, cumulative ETH volume exceeded | `evaluate` | Checks the `Meaning` against a `Grant`; returns a list of `EvalViolation`s |
| `create_grant` | Inserts policy-specific rows; returns the specific grant ID |
**TokenTransfer** — ERC-20 `transfer(address,uint256)` calls | `try_find_grant` | Finds a matching non-revoked grant for the given `EvalContext` |
| `find_all_grants` | Returns all non-revoked grants (used for listing) |
- Recognised by ABI-decoding the `transfer(address,uint256)` selector against a static registry of known token contracts (`arbiter_tokens_registry`) | `record_transaction` | Persists policy-specific data after execution |
- Grant requires: token contract address, optional recipient restriction, zero or more volumetric rate limits
- Violations: recipient mismatch, any volumetric limit exceeded `analyze` and `evaluate` are intentionally separate: classification is pure and cheap, while evaluation may involve DB queries (e.g., fetching past transfer volume).
### Grant Model ### Registered Policies
Every grant has two layers: **EtherTransfer** — plain ETH transfers (empty calldata)
- **Shared (`evm_basic_grant`)** — wallet, chain, validity period, gas fee caps, transaction count rate limit. One row per grant regardless of type. - Grant requires: allowlist of recipient addresses + one volumetric rate limit (max ETH over a time window)
- **Specific** — policy-owned tables (`evm_ether_transfer_grant`, `evm_token_transfer_grant`) holding type-specific configuration. - Violations: recipient not in allowlist, cumulative ETH volume exceeded
`find_all_grants` uses a `#[diesel::auto_type]` base join between the specific and shared tables, then batch-loads related rows (targets, volume limits) in two additional queries to avoid N+1. **TokenTransfer** — ERC-20 `transfer(address,uint256)` calls
The engine exposes `list_all_grants` which collects across all policy types into `Vec<Grant<SpecificGrant>>` via a blanket `From<Grant<S>> for Grant<SpecificGrant>` conversion. - Recognised by ABI-decoding the `transfer(address,uint256)` selector against a static registry of known token contracts (`arbiter_tokens_registry`)
- Grant requires: token contract address, optional recipient restriction, zero or more volumetric rate limits
### Shared Constraints (enforced by the engine) - Violations: recipient mismatch, any volumetric limit exceeded
These are checked centrally in `check_shared_constraints` before policy evaluation: ### Grant Model
| Constraint | Fields | Behaviour | Every grant has two layers:
|---|---|---|
| Validity window | `valid_from`, `valid_until` | Emits `InvalidTime` if current time is outside the range | - **Shared (`evm_basic_grant`)** — wallet, chain, validity period, gas fee caps, transaction count rate limit. One row per grant regardless of type.
| Gas fee cap | `max_gas_fee_per_gas`, `max_priority_fee_per_gas` | Emits `GasLimitExceeded` if either cap is breached | - **Specific** — policy-owned tables (`evm_ether_transfer_grant`, `evm_token_transfer_grant`) holding type-specific configuration.
| Tx count rate limit | `rate_limit` (`count` + `window`) | Counts rows in `evm_transaction_log` within the window; emits `RateLimitExceeded` if at or above the limit |
`find_all_grants` uses a `#[diesel::auto_type]` base join between the specific and shared tables, then batch-loads related rows (targets, volume limits) in two additional queries to avoid N+1.
---
The engine exposes `list_all_grants` which collects across all policy types into `Vec<Grant<SpecificGrant>>` via a blanket `From<Grant<S>> for Grant<SpecificGrant>` conversion.
### Known Limitations
### Shared Constraints (enforced by the engine)
- **Only EIP-1559 transactions are supported.** Legacy and EIP-2930 types are rejected outright.
- **No opaque-calldata (unknown contract) grant type.** The architecture describes a category for unrecognised contracts, but no policy implements it yet. Any transaction that is not a plain ETH transfer or a known ERC-20 transfer is unconditionally rejected. These are checked centrally in `check_shared_constraints` before policy evaluation:
- **Token registry is static.** Tokens are recognised only if they appear in the hard-coded `arbiter_tokens_registry` crate. There is no mechanism to register additional contracts at runtime.
| Constraint | Fields | Behaviour |
--- |---|---|---|
| Validity window | `valid_from`, `valid_until` | Emits `InvalidTime` if current time is outside the range |
## Memory Protection | Gas fee cap | `max_gas_fee_per_gas`, `max_priority_fee_per_gas` | Emits `GasLimitExceeded` if either cap is breached |
| Tx count rate limit | `rate_limit` (`count` + `window`) | Counts rows in `evm_transaction_log` within the window; emits `RateLimitExceeded` if at or above the limit |
The unsealed root key must be held in a hardened memory cell resistant to dumps, page swaps, and hibernation.
---
- **Current:** A dedicated memory-protection abstraction is in place, with `memsafe` used behind that abstraction today
- **Planned:** Additional backends can be introduced behind the same abstraction, including a custom implementation based on `mlock` (Unix) and `VirtualProtect` (Windows) ### Known Limitations
- **Only EIP-1559 transactions are supported.** Legacy and EIP-2930 types are rejected outright.
- **No opaque-calldata (unknown contract) grant type.** The architecture describes a category for unrecognised contracts, but no policy implements it yet. Any transaction that is not a plain ETH transfer or a known ERC-20 transfer is unconditionally rejected.
- **Token registry is static.** Tokens are recognised only if they appear in the hard-coded `arbiter_tokens_registry` crate. There is no mechanism to register additional contracts at runtime.
---
## Memory Protection
The unsealed root key must be held in a hardened memory cell resistant to dumps, page swaps, and hibernation.
- **Current:** A dedicated memory-protection abstraction is in place, with `memsafe` used behind that abstraction today
- **Planned:** Additional backends can be introduced behind the same abstraction, including a custom implementation based on `mlock` (Unix) and `VirtualProtect` (Windows)

380
LICENSE
View File

@@ -1,190 +1,190 @@
Apache License Apache License
Version 2.0, January 2004 Version 2.0, January 2004
http://www.apache.org/licenses/ http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions. 1. Definitions.
"License" shall mean the terms and conditions for use, reproduction, "License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document. and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by "Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License. the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all "Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition, control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the "control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity. outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity "You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License. exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications, "Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation including but not limited to software source code, documentation
source, and configuration files. source, and configuration files.
"Object" form shall mean any form resulting from mechanical "Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation, not limited to compiled object code, generated documentation,
and conversions to other media types. and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or "Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work copyright notice that is included in or attached to the work
(an example is provided in the Appendix below). (an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object "Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of, separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof. the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including "Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted" the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems, communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution." designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity "Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work. subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of 2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual, this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of, copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form. Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of 3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual, this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made, (except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work, use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s) Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate granted to You under this License for that Work shall terminate
as of the date such litigation is filed. as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the 4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You modifications, and in Source or Object form, provided that You
meet the following conditions: meet the following conditions:
(a) You must give any other recipients of the Work or (a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices (b) You must cause any modified files to carry prominent notices
stating that You changed the files; and stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works (c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work, attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of excluding those notices that do not pertain to any part of
the Derivative Works; and the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its (d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or, documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed that such additional attribution notices cannot be construed
as modifying the License. as modifying the License.
You may add Your own copyright statement to Your modifications and You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use, for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License. the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise, 5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions. this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions. with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade 6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor, names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file. origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or 7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS, Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License. risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory, 8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise, whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special, liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill, Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages. has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing 9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer, the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity, and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify, of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability. of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS END OF TERMS AND CONDITIONS
Copyright 2026 MarketTakers Copyright 2026 MarketTakers
Licensed under the Apache License, Version 2.0 (the "License"); Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0 http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS, distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and See the License for the specific language governing permissions and
limitations under the License. limitations under the License.

24
README.md
View File

@@ -1,13 +1,13 @@
# Arbiter # Arbiter
> Policy-first multi-client wallet daemon, allowing permissioned transactions across blockchains > Policy-first multi-client wallet daemon, allowing permissioned transactions across blockchains
## Security warning ## Security warning
Arbiter can't meaningfully protect against host compromise. Potential attack flow: Arbiter can't meaningfully protect against host compromise. Potential attack flow:
- Attacker steals TLS keys from database - Attacker steals TLS keys from database
- Pretends to be server; just accepts operator challenge solutions - Pretends to be server; just accepts user agent challenge solutions
- Pretend to be in sealed state and performing DH with client - Pretend to be in sealed state and performing DH with client
- Steals user password and derives seal key - Steals user password and derives seal key
While this attack is highly targetive, it's still possible. While this attack is highly targetive, it's still possible.
> This software is experimental. Do not use with funds you cannot afford to lose. > This software is experimental. Do not use with funds you cannot afford to lose.

62
app/.dart_tool/extension_discovery/README.md
View File

@@ -1,31 +1,31 @@
Extension Discovery Cache Extension Discovery Cache
========================= =========================
This folder is used by `package:extension_discovery` to cache lists of This folder is used by `package:extension_discovery` to cache lists of
packages that contains extensions for other packages. packages that contains extensions for other packages.
DO NOT USE THIS FOLDER DO NOT USE THIS FOLDER
---------------------- ----------------------
* Do not read (or rely) the contents of this folder. * Do not read (or rely) the contents of this folder.
* Do write to this folder. * Do write to this folder.
If you're interested in the lists of extensions stored in this folder use the If you're interested in the lists of extensions stored in this folder use the
API offered by package `extension_discovery` to get this information. API offered by package `extension_discovery` to get this information.
If this package doesn't work for your use-case, then don't try to read the If this package doesn't work for your use-case, then don't try to read the
contents of this folder. It may change, and will not remain stable. contents of this folder. It may change, and will not remain stable.
Use package `extension_discovery` Use package `extension_discovery`
--------------------------------- ---------------------------------
If you want to access information from this folder. If you want to access information from this folder.
Feel free to delete this folder Feel free to delete this folder
------------------------------- -------------------------------
Files in this folder act as a cache, and the cache is discarded if the files Files in this folder act as a cache, and the cache is discarded if the files
are older than the modification time of `.dart_tool/package_config.json`. are older than the modification time of `.dart_tool/package_config.json`.
Hence, it should never be necessary to clear this cache manually, if you find a Hence, it should never be necessary to clear this cache manually, if you find a
need to do please file a bug. need to do please file a bug.

356
app/.dart_tool/package_config.json
View File

@@ -1,178 +1,178 @@
{ {
"configVersion": 2, "configVersion": 2,
"packages": [ "packages": [
{ {
"name": "async", "name": "async",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "boolean_selector", "name": "boolean_selector",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "characters", "name": "characters",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "clock", "name": "clock",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "collection", "name": "collection",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "cupertino_icons", "name": "cupertino_icons",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "fake_async", "name": "fake_async",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.3" "languageVersion": "3.3"
}, },
{ {
"name": "flutter", "name": "flutter",
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter", "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "flutter_lints", "name": "flutter_lints",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "flutter_test", "name": "flutter_test",
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test", "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "leak_tracker", "name": "leak_tracker",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.2" "languageVersion": "3.2"
}, },
{ {
"name": "leak_tracker_flutter_testing", "name": "leak_tracker_flutter_testing",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.2" "languageVersion": "3.2"
}, },
{ {
"name": "leak_tracker_testing", "name": "leak_tracker_testing",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.2" "languageVersion": "3.2"
}, },
{ {
"name": "lints", "name": "lints",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "matcher", "name": "matcher",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "material_color_utilities", "name": "material_color_utilities",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "2.17" "languageVersion": "2.17"
}, },
{ {
"name": "meta", "name": "meta",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.5" "languageVersion": "3.5"
}, },
{ {
"name": "path", "name": "path",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "sky_engine", "name": "sky_engine",
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine", "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "source_span", "name": "source_span",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "stack_trace", "name": "stack_trace",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "stream_channel", "name": "stream_channel",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.3" "languageVersion": "3.3"
}, },
{ {
"name": "string_scanner", "name": "string_scanner",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "term_glyph", "name": "term_glyph",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "test_api", "name": "test_api",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.5" "languageVersion": "3.5"
}, },
{ {
"name": "vector_math", "name": "vector_math",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "vm_service", "name": "vm_service",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.5" "languageVersion": "3.5"
}, },
{ {
"name": "app", "name": "app",
"rootUri": "../", "rootUri": "../",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.10" "languageVersion": "3.10"
} }
], ],
"generator": "pub", "generator": "pub",
"generatorVersion": "3.10.8", "generatorVersion": "3.10.8",
"flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable", "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
"flutterVersion": "3.38.9", "flutterVersion": "3.38.9",
"pubCache": "file:///Users/kaska/.pub-cache" "pubCache": "file:///Users/kaska/.pub-cache"
} }

458
app/.dart_tool/package_graph.json
View File

@@ -1,230 +1,230 @@
{ {
"roots": [ "roots": [
"app" "app"
], ],
"packages": [ "packages": [
{ {
"name": "app", "name": "app",
"version": "1.0.0+1", "version": "1.0.0+1",
"dependencies": [ "dependencies": [
"cupertino_icons", "cupertino_icons",
"flutter" "flutter"
], ],
"devDependencies": [ "devDependencies": [
"flutter_lints", "flutter_lints",
"flutter_test" "flutter_test"
] ]
}, },
{ {
"name": "flutter_lints", "name": "flutter_lints",
"version": "6.0.0", "version": "6.0.0",
"dependencies": [ "dependencies": [
"lints" "lints"
] ]
}, },
{ {
"name": "flutter_test", "name": "flutter_test",
"version": "0.0.0", "version": "0.0.0",
"dependencies": [ "dependencies": [
"clock", "clock",
"collection", "collection",
"fake_async", "fake_async",
"flutter", "flutter",
"leak_tracker_flutter_testing", "leak_tracker_flutter_testing",
"matcher", "matcher",
"meta", "meta",
"path", "path",
"stack_trace", "stack_trace",
"stream_channel", "stream_channel",
"test_api", "test_api",
"vector_math" "vector_math"
] ]
}, },
{ {
"name": "cupertino_icons", "name": "cupertino_icons",
"version": "1.0.8", "version": "1.0.8",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "flutter", "name": "flutter",
"version": "0.0.0", "version": "0.0.0",
"dependencies": [ "dependencies": [
"characters", "characters",
"collection", "collection",
"material_color_utilities", "material_color_utilities",
"meta", "meta",
"sky_engine", "sky_engine",
"vector_math" "vector_math"
] ]
}, },
{ {
"name": "lints", "name": "lints",
"version": "6.1.0", "version": "6.1.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "stream_channel", "name": "stream_channel",
"version": "2.1.4", "version": "2.1.4",
"dependencies": [ "dependencies": [
"async" "async"
] ]
}, },
{ {
"name": "meta", "name": "meta",
"version": "1.17.0", "version": "1.17.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "collection", "name": "collection",
"version": "1.19.1", "version": "1.19.1",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "leak_tracker_flutter_testing", "name": "leak_tracker_flutter_testing",
"version": "3.0.10", "version": "3.0.10",
"dependencies": [ "dependencies": [
"flutter", "flutter",
"leak_tracker", "leak_tracker",
"leak_tracker_testing", "leak_tracker_testing",
"matcher", "matcher",
"meta" "meta"
] ]
}, },
{ {
"name": "vector_math", "name": "vector_math",
"version": "2.2.0", "version": "2.2.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "stack_trace", "name": "stack_trace",
"version": "1.12.1", "version": "1.12.1",
"dependencies": [ "dependencies": [
"path" "path"
] ]
}, },
{ {
"name": "clock", "name": "clock",
"version": "1.1.2", "version": "1.1.2",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "fake_async", "name": "fake_async",
"version": "1.3.3", "version": "1.3.3",
"dependencies": [ "dependencies": [
"clock", "clock",
"collection" "collection"
] ]
}, },
{ {
"name": "path", "name": "path",
"version": "1.9.1", "version": "1.9.1",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "matcher", "name": "matcher",
"version": "0.12.17", "version": "0.12.17",
"dependencies": [ "dependencies": [
"async", "async",
"meta", "meta",
"stack_trace", "stack_trace",
"term_glyph", "term_glyph",
"test_api" "test_api"
] ]
}, },
{ {
"name": "test_api", "name": "test_api",
"version": "0.7.7", "version": "0.7.7",
"dependencies": [ "dependencies": [
"async", "async",
"boolean_selector", "boolean_selector",
"collection", "collection",
"meta", "meta",
"source_span", "source_span",
"stack_trace", "stack_trace",
"stream_channel", "stream_channel",
"string_scanner", "string_scanner",
"term_glyph" "term_glyph"
] ]
}, },
{ {
"name": "sky_engine", "name": "sky_engine",
"version": "0.0.0", "version": "0.0.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "material_color_utilities", "name": "material_color_utilities",
"version": "0.11.1", "version": "0.11.1",
"dependencies": [ "dependencies": [
"collection" "collection"
] ]
}, },
{ {
"name": "characters", "name": "characters",
"version": "1.4.0", "version": "1.4.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "async", "name": "async",
"version": "2.13.0", "version": "2.13.0",
"dependencies": [ "dependencies": [
"collection", "collection",
"meta" "meta"
] ]
}, },
{ {
"name": "leak_tracker_testing", "name": "leak_tracker_testing",
"version": "3.0.2", "version": "3.0.2",
"dependencies": [ "dependencies": [
"leak_tracker", "leak_tracker",
"matcher", "matcher",
"meta" "meta"
] ]
}, },
{ {
"name": "leak_tracker", "name": "leak_tracker",
"version": "11.0.2", "version": "11.0.2",
"dependencies": [ "dependencies": [
"clock", "clock",
"collection", "collection",
"meta", "meta",
"path", "path",
"vm_service" "vm_service"
] ]
}, },
{ {
"name": "term_glyph", "name": "term_glyph",
"version": "1.2.2", "version": "1.2.2",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "string_scanner", "name": "string_scanner",
"version": "1.4.1", "version": "1.4.1",
"dependencies": [ "dependencies": [
"source_span" "source_span"
] ]
}, },
{ {
"name": "source_span", "name": "source_span",
"version": "1.10.2", "version": "1.10.2",
"dependencies": [ "dependencies": [
"collection", "collection",
"path", "path",
"term_glyph" "term_glyph"
] ]
}, },
{ {
"name": "boolean_selector", "name": "boolean_selector",
"version": "2.1.2", "version": "2.1.2",
"dependencies": [ "dependencies": [
"source_span", "source_span",
"string_scanner" "string_scanner"
] ]
}, },
{ {
"name": "vm_service", "name": "vm_service",
"version": "15.0.2", "version": "15.0.2",
"dependencies": [] "dependencies": []
} }
], ],
"configVersion": 1 "configVersion": 1
} }

22
app/macos/Flutter/ephemeral/Flutter-Generated.xcconfig
View File

@@ -1,11 +1,11 @@
// This is a generated file; do not edit or check into version control. // This is a generated file; do not edit or check into version control.
FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable
FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app
COCOAPODS_PARALLEL_CODE_SIGN=true COCOAPODS_PARALLEL_CODE_SIGN=true
FLUTTER_BUILD_DIR=build FLUTTER_BUILD_DIR=build
FLUTTER_BUILD_NAME=1.0.0 FLUTTER_BUILD_NAME=1.0.0
FLUTTER_BUILD_NUMBER=1 FLUTTER_BUILD_NUMBER=1
DART_OBFUSCATION=false DART_OBFUSCATION=false
TRACK_WIDGET_CREATION=true TRACK_WIDGET_CREATION=true
TREE_SHAKE_ICONS=false TREE_SHAKE_ICONS=false
PACKAGE_CONFIG=.dart_tool/package_config.json PACKAGE_CONFIG=.dart_tool/package_config.json

24
app/macos/Flutter/ephemeral/flutter_export_environment.sh
View File

@@ -1,12 +1,12 @@
#!/bin/sh #!/bin/sh
# This is a generated file; do not edit or check into version control. # This is a generated file; do not edit or check into version control.
export "FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable" export "FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable"
export "FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app" export "FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app"
export "COCOAPODS_PARALLEL_CODE_SIGN=true" export "COCOAPODS_PARALLEL_CODE_SIGN=true"
export "FLUTTER_BUILD_DIR=build" export "FLUTTER_BUILD_DIR=build"
export "FLUTTER_BUILD_NAME=1.0.0" export "FLUTTER_BUILD_NAME=1.0.0"
export "FLUTTER_BUILD_NUMBER=1" export "FLUTTER_BUILD_NUMBER=1"
export "DART_OBFUSCATION=false" export "DART_OBFUSCATION=false"
export "TRACK_WIDGET_CREATION=true" export "TRACK_WIDGET_CREATION=true"
export "TREE_SHAKE_ICONS=false" export "TREE_SHAKE_ICONS=false"
export "PACKAGE_CONFIG=.dart_tool/package_config.json" export "PACKAGE_CONFIG=.dart_tool/package_config.json"

2616
docs/superpowers/plans/2026-03-28-grant-creation-refactor.md
View File

File diff suppressed because it is too large Load Diff

1642
docs/superpowers/plans/2026-03-28-grant-grid-view.md
View File

File diff suppressed because it is too large Load Diff

340
docs/superpowers/specs/2026-03-28-grant-grid-view-design.md
View File

@@ -1,170 +1,170 @@
# Grant Grid View — Design Spec # Grant Grid View — Design Spec
**Date:** 2026-03-28 **Date:** 2026-03-28
## Overview ## Overview
Add a "Grants" dashboard tab to the Flutter operator app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About. Add a "Grants" dashboard tab to the Flutter user-agent app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About.
## Scope ## Scope
- New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs - New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs
- New `EvmGrantsScreen` as a dashboard tab - New `EvmGrantsScreen` as a dashboard tab
- Grant card widget with enriched display (type, chain, wallet, client) - Grant card widget with enriched display (type, chain, wallet, client)
- Revoke action wired to existing `executeRevokeEvmGrant` mutation - Revoke action wired to existing `executeRevokeEvmGrant` mutation
- Dashboard tab bar and router updated - Dashboard tab bar and router updated
- New token-transfer accent color added to `Palette` - New token-transfer accent color added to `Palette`
**Out of scope:** Fixing grant creation (separate task). **Out of scope:** Fixing grant creation (separate task).
--- ---
## Data Layer ## Data Layer
### `walletAccessListProvider` ### `walletAccessListProvider`
**File:** `operator/lib/providers/sdk_clients/wallet_access_list.dart` **File:** `useragent/lib/providers/sdk_clients/wallet_access_list.dart`
- `@riverpod` class, watches `connectionManagerProvider.future` - `@riverpod` class, watches `connectionManagerProvider.future`
- Returns `List<SdkClientWalletAccess>?` (null when not connected) - Returns `List<SdkClientWalletAccess>?` (null when not connected)
- Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId` - Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId`
- Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()` - Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()`
### Enrichment at render time (Approach A) ### Enrichment at render time (Approach A)
The `EvmGrantsScreen` watches four providers: The `EvmGrantsScreen` watches four providers:
1. `evmGrantsProvider` — the grant list 1. `evmGrantsProvider` — the grant list
2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id) 2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id)
3. `evmProvider` — to resolve wallet_id → wallet address 3. `evmProvider` — to resolve wallet_id → wallet address
4. `sdkClientsProvider` — to resolve sdk_client_id → client name 4. `sdkClientsProvider` — to resolve sdk_client_id → client name
All lookups are in-memory Maps built inside the build method; no extra model class needed. All lookups are in-memory Maps built inside the build method; no extra model class needed.
Fallbacks: Fallbacks:
- Wallet address not found → `"Access #N"` where N is the wallet_access_id - Wallet address not found → `"Access #N"` where N is the wallet_access_id
- Client name not found → `"Client #N"` where N is the sdk_client_id - Client name not found → `"Client #N"` where N is the sdk_client_id
--- ---
## Route Structure ## Route Structure
``` ```
/dashboard /dashboard
/evm ← existing (Wallets tab) /evm ← existing (Wallets tab)
/clients ← existing (Clients tab) /clients ← existing (Clients tab)
/grants ← NEW (Grants tab) /grants ← NEW (Grants tab)
/about ← existing /about ← existing
/evm-grants/create ← existing push route (unchanged) /evm-grants/create ← existing push route (unchanged)
``` ```
### Changes to `router.dart` ### Changes to `router.dart`
Add inside dashboard children: Add inside dashboard children:
```dart ```dart
AutoRoute(page: EvmGrantsRoute.page, path: 'grants'), AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
``` ```
### Changes to `dashboard.dart` ### Changes to `dashboard.dart`
Add to `routes` list: Add to `routes` list:
```dart ```dart
const EvmGrantsRoute() const EvmGrantsRoute()
``` ```
Add `NavigationDestination`: Add `NavigationDestination`:
```dart ```dart
NavigationDestination( NavigationDestination(
icon: Icon(Icons.policy_outlined), icon: Icon(Icons.policy_outlined),
selectedIcon: Icon(Icons.policy), selectedIcon: Icon(Icons.policy),
label: 'Grants', label: 'Grants',
), ),
``` ```
--- ---
## Screen: `EvmGrantsScreen` ## Screen: `EvmGrantsScreen`
**File:** `operator/lib/screens/dashboard/evm/grants/grants.dart` **File:** `useragent/lib/screens/dashboard/evm/grants/grants.dart`
``` ```
Scaffold Scaffold
└─ SafeArea └─ SafeArea
└─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider) └─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider)
└─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics) └─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics)
├─ PageHeader ├─ PageHeader
│ title: 'EVM Grants' │ title: 'EVM Grants'
│ isBusy: evmGrantsProvider.isLoading │ isBusy: evmGrantsProvider.isLoading
│ actions: [CreateGrantButton, RefreshButton] │ actions: [CreateGrantButton, RefreshButton]
├─ SizedBox(height: 1.8.h) ├─ SizedBox(height: 1.8.h)
└─ <content> └─ <content>
``` ```
### State handling ### State handling
Matches the pattern from `EvmScreen` and `ClientsScreen`: Matches the pattern from `EvmScreen` and `ClientsScreen`:
| State | Display | | State | Display |
|---|---| |---|---|
| Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" | | Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" |
| Error | `_StatePanel` with coral icon, error message, Retry button | | Error | `_StatePanel` with coral icon, error message, Retry button |
| No connection | `_StatePanel`, "No active server connection" | | No connection | `_StatePanel`, "No active server connection" |
| Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut | | Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut |
| Data | Column of `_GrantCard` widgets | | Data | Column of `_GrantCard` widgets |
### Header actions ### Header actions
**CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`. **CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`.
**RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`. **RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`.
--- ---
## Grant Card: `_GrantCard` ## Grant Card: `_GrantCard`
**Layout:** **Layout:**
``` ```
Container (rounded 24, Palette.cream bg, Palette.line border) Container (rounded 24, Palette.cream bg, Palette.line border)
└─ IntrinsicHeight > Row └─ IntrinsicHeight > Row
├─ Accent strip (0.8.w wide, full height, rounded left) ├─ Accent strip (0.8.w wide, full height, rounded left)
└─ Padding > Column └─ Padding > Column
├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton ├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton
└─ Row 2: WalletText + "·" + ClientText └─ Row 2: WalletText + "·" + ClientText
``` ```
**Accent color by grant type:** **Accent color by grant type:**
- Ether transfer → `Palette.coral` - Ether transfer → `Palette.coral`
- Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`) - Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`)
**TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`. **TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`.
**ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color. **ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color.
**WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family. **WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family.
**ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink. **ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink.
**RevokeButton:** **RevokeButton:**
- `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'` - `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'`
- `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))` - `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))`
- Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight - Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight
- On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error - On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error
--- ---
## Adaptive Sizing ## Adaptive Sizing
All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values. All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values.
--- ---
## Files to Create / Modify ## Files to Create / Modify
| File | Action | | File | Action |
|---|---| |---|---|
| `lib/theme/palette.dart` | Modify — add `Palette.token` color | | `lib/theme/palette.dart` | Modify — add `Palette.token` color |
| `lib/providers/sdk_clients/wallet_access_list.dart` | Create | | `lib/providers/sdk_clients/wallet_access_list.dart` | Create |
| `lib/screens/dashboard/evm/grants/grants.dart` | Create | | `lib/screens/dashboard/evm/grants/grants.dart` | Create |
| `lib/router.dart` | Modify — add grants route to dashboard children | | `lib/router.dart` | Modify — add grants route to dashboard children |
| `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations | | `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations |

89
mise.lock
View File

@@ -1,59 +1,55 @@
# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
[[tools.ast-grep]] [[tools.ast-grep]]
version = "0.42.1" version = "0.42.0"
backend = "aqua:ast-grep/ast-grep" backend = "aqua:ast-grep/ast-grep"
[tools.ast-grep."platforms.linux-arm64"] [tools.ast-grep."platforms.linux-arm64"]
checksum = "sha256:3ba383839044cf9817929435f5ce0027f91d06931e8efb32d942e58d73d92be5" checksum = "sha256:5c830eae8456569e2f7212434ed9c238f58dca412d76045418ed6d394a755836"
url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-unknown-linux-gnu.zip" url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-unknown-linux-gnu.zip"
[tools.ast-grep."platforms.linux-arm64-musl"] [tools.ast-grep."platforms.linux-arm64-musl"]
checksum = "sha256:3ba383839044cf9817929435f5ce0027f91d06931e8efb32d942e58d73d92be5" checksum = "sha256:5c830eae8456569e2f7212434ed9c238f58dca412d76045418ed6d394a755836"
url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-unknown-linux-gnu.zip" url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-unknown-linux-gnu.zip"
[tools.ast-grep."platforms.linux-x64"] [tools.ast-grep."platforms.linux-x64"]
checksum = "sha256:5de8b87cba67fc8dc3e239d54b6484802ad745a7ae3de76be4fe89661dc52657" checksum = "sha256:e825a05603f0bcc4cd9076c4cc8c9abd6d008b7cd07d9aa3cc323ba4b8606651"
url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-unknown-linux-gnu.zip" url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-unknown-linux-gnu.zip"
[tools.ast-grep."platforms.linux-x64-musl"] [tools.ast-grep."platforms.linux-x64-musl"]
checksum = "sha256:5de8b87cba67fc8dc3e239d54b6484802ad745a7ae3de76be4fe89661dc52657" checksum = "sha256:e825a05603f0bcc4cd9076c4cc8c9abd6d008b7cd07d9aa3cc323ba4b8606651"
url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-unknown-linux-gnu.zip" url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-unknown-linux-gnu.zip"
[tools.ast-grep."platforms.macos-arm64"] [tools.ast-grep."platforms.macos-arm64"]
checksum = "sha256:c3961d8e8a4ee0ce2d0d98c7beeb168bb331cdc766b53630118a7b6c4fd39015" checksum = "sha256:fc300d5293b1c770a5aece03a8a193b92e71e87cec726c28096990691a582620"
url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-apple-darwin.zip" url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-aarch64-apple-darwin.zip"
[tools.ast-grep."platforms.macos-x64"] [tools.ast-grep."platforms.macos-x64"]
checksum = "sha256:a038965bfd7fe44257c771cdf8918dc3467dd8ec0eef673b8b14f639b144cdbd" checksum = "sha256:979ffe611327056f4730a1ae71b0209b3b830f58b22c6ed194cda34f55400db2"
url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-apple-darwin.zip" url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-apple-darwin.zip"
[tools.ast-grep."platforms.windows-x64"] [tools.ast-grep."platforms.windows-x64"]
checksum = "sha256:fe34f631bb24c08ad146f92ca2a92971a53d179461b509fd8d32dc863bff9f83" checksum = "sha256:55836fa1b2c65dc7d61615a4d9368622a0d2371a76d28b9a165e5a3ab6ae32a4"
url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-pc-windows-msvc.zip" url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.0/app-x86_64-pc-windows-msvc.zip"
[[tools."cargo:cargo-audit"]] [[tools."cargo:cargo-audit"]]
version = "0.22.1" version = "0.22.1"
backend = "cargo:cargo-audit" backend = "cargo:cargo-audit"
[[tools."cargo:cargo-edit"]] [[tools."cargo:cargo-edit"]]
version = "0.13.10" version = "0.13.9"
backend = "cargo:cargo-edit" backend = "cargo:cargo-edit"
[[tools."cargo:cargo-features-manager"]] [[tools."cargo:cargo-features-manager"]]
version = "0.12.0" version = "0.11.1"
backend = "cargo:cargo-features-manager" backend = "cargo:cargo-features-manager"
[[tools."cargo:cargo-insta"]] [[tools."cargo:cargo-insta"]]
version = "1.47.2" version = "1.46.3"
backend = "cargo:cargo-insta" backend = "cargo:cargo-insta"
[[tools."cargo:cargo-mutants"]]
version = "27.0.0"
backend = "cargo:cargo-mutants"
[[tools."cargo:cargo-nextest"]] [[tools."cargo:cargo-nextest"]]
version = "0.9.133" version = "0.9.126"
backend = "cargo:cargo-nextest" backend = "cargo:cargo-nextest"
[[tools."cargo:cargo-shear"]] [[tools."cargo:cargo-shear"]]
@@ -65,19 +61,15 @@ version = "0.10.2"
backend = "cargo:cargo-vet" backend = "cargo:cargo-vet"
[[tools."cargo:diesel_cli"]] [[tools."cargo:diesel_cli"]]
version = "2.3.7" version = "2.3.6"
backend = "cargo:diesel_cli" backend = "cargo:diesel_cli"
[tools."cargo:diesel_cli".options] [tools."cargo:diesel_cli".options]
default-features = "false" default-features = "false"
features = "sqlite,sqlite-bundled" features = "sqlite,sqlite-bundled"
[[tools."cargo:flutter_rust_bridge_codegen"]]
version = "2.12.0"
backend = "cargo:flutter_rust_bridge_codegen"
[[tools.flutter]] [[tools.flutter]]
version = "3.41.7-stable" version = "3.38.9-stable"
backend = "asdf:flutter" backend = "asdf:flutter"
[[tools.protoc]] [[tools.protoc]]
@@ -113,44 +105,37 @@ checksum = "sha256:1ebd7c87baffb9f1c47169b640872bf5fb1e4408079c691af527be9561d8f
url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-win64.zip" url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-win64.zip"
[[tools.python]] [[tools.python]]
version = "3.14.4" version = "3.14.3"
backend = "core:python" backend = "core:python"
[tools.python."platforms.linux-arm64"] [tools.python."platforms.linux-arm64"]
checksum = "sha256:b8b597fdb2f8dccdc502c11947b60a4b65eb6bce79cfa60c7ccf9b6e8352c60a" checksum = "sha256:53700338695e402a1a1fe22be4a41fbdacc70e22bb308a48eca8ed67cb7992be"
url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz" url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
provenance = "github-attestations"
[tools.python."platforms.linux-arm64-musl"] [tools.python."platforms.linux-arm64-musl"]
checksum = "sha256:b8b597fdb2f8dccdc502c11947b60a4b65eb6bce79cfa60c7ccf9b6e8352c60a" checksum = "sha256:53700338695e402a1a1fe22be4a41fbdacc70e22bb308a48eca8ed67cb7992be"
url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz" url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
provenance = "github-attestations"
[tools.python."platforms.linux-x64"] [tools.python."platforms.linux-x64"]
checksum = "sha256:fe9a9c32d13870af632cbac3dfc7528ae53597e94472aa4c7d6a42e8166136cd" checksum = "sha256:d7a9f970914bb4c88756fe3bdcc186d4feb90e9500e54f1db47dae4dc9687e39"
url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz" url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
provenance = "github-attestations"
[tools.python."platforms.linux-x64-musl"] [tools.python."platforms.linux-x64-musl"]
checksum = "sha256:fe9a9c32d13870af632cbac3dfc7528ae53597e94472aa4c7d6a42e8166136cd" checksum = "sha256:d7a9f970914bb4c88756fe3bdcc186d4feb90e9500e54f1db47dae4dc9687e39"
url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz" url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
provenance = "github-attestations"
[tools.python."platforms.macos-arm64"] [tools.python."platforms.macos-arm64"]
checksum = "blake3:0314ec66e0f33ec04959583b5900bc8edae371a396aa96b8874e750d1fe936e6" checksum = "sha256:c43aecde4a663aebff99b9b83da0efec506479f1c3f98331442f33d2c43501f9"
url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-apple-darwin-install_only_stripped.tar.gz" url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-aarch64-apple-darwin-install_only_stripped.tar.gz"
provenance = "github-attestations"
[tools.python."platforms.macos-x64"] [tools.python."platforms.macos-x64"]
checksum = "sha256:d51250a32fa5d9f0799c7bcb71720c27b10a3afd4a7de288120f96085d508a5a" checksum = "sha256:9ab41dbc2f100a2a45d1833b9c11165f51051c558b5213eda9a9731d5948a0c0"
url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-apple-darwin-install_only_stripped.tar.gz" url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-apple-darwin-install_only_stripped.tar.gz"
provenance = "github-attestations"
[tools.python."platforms.windows-x64"] [tools.python."platforms.windows-x64"]
checksum = "sha256:a976991dcd085c1bb5d9a8084823a6bc8b7f9b079d8c432574a6ddd68c3a6fe1" checksum = "sha256:bbe19034b35b0267176a7442575ae7dc6343480fd4d35598cb7700173d431e09"
url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-pc-windows-msvc-install_only_stripped.tar.gz" url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260324/cpython-3.14.3+20260324-x86_64-pc-windows-msvc-install_only_stripped.tar.gz"
provenance = "github-attestations"
[[tools.rust]] [[tools.rust]]
version = "1.95.0" version = "1.93.0"
backend = "core:rust" backend = "core:rust"

46
mise.toml
View File

@@ -1,24 +1,22 @@
[tools] [tools]
"cargo:diesel_cli" = { version = "2.3.7", features = "sqlite,sqlite-bundled", default-features = "false" } "cargo:diesel_cli" = { version = "2.3.6", features = "sqlite,sqlite-bundled", default-features = false }
"cargo:cargo-audit" = "0.22.1" "cargo:cargo-audit" = "0.22.1"
"cargo:cargo-vet" = "0.10.2" "cargo:cargo-vet" = "0.10.2"
flutter = "3.41.7-stable" flutter = "3.38.9-stable"
protoc = "29.6" protoc = "29.6"
rust = { version = "1.95.0", components = "clippy,rust-analyzer" } "rust" = {version = "1.93.0", components = "clippy"}
"cargo:cargo-features-manager" = "0.12.0" "cargo:cargo-features-manager" = "0.11.1"
"cargo:cargo-nextest" = "0.9.133" "cargo:cargo-nextest" = "0.9.126"
"cargo:cargo-shear" = "latest" "cargo:cargo-shear" = "latest"
"cargo:cargo-insta" = "1.47.2" "cargo:cargo-insta" = "1.46.3"
python = "3.14.4" python = "3.14.3"
ast-grep = "0.42.1" ast-grep = "0.42.0"
"cargo:cargo-edit" = "0.13.10" "cargo:cargo-edit" = "0.13.9"
"cargo:cargo-mutants" = "27.0.0"
"cargo:flutter_rust_bridge_codegen" = "2.12.0" [tasks.codegen]
sources = ['protobufs/*.proto', 'protobufs/**/*.proto']
[tasks.codegen] outputs = ['useragent/lib/proto/**']
sources = ['protobufs/*.proto', 'protobufs/**/*.proto'] run = '''
outputs = ['useragent/lib/proto/**'] dart pub global activate protoc_plugin && \
run = ''' protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
dart pub global activate protoc_plugin && \ '''
protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
'''

32
protobufs/arbiter.proto
View File

@@ -1,16 +1,16 @@
syntax = "proto3"; syntax = "proto3";
package arbiter; package arbiter;
import "client.proto"; import "client.proto";
import "operator.proto"; import "user_agent.proto";
message ServerInfo { message ServerInfo {
string version = 1; string version = 1;
bytes cert_public_key = 2; bytes cert_public_key = 2;
} }
service ArbiterService { service ArbiterService {
rpc Client(stream arbiter.client.ClientRequest) returns (stream arbiter.client.ClientResponse); rpc Client(stream arbiter.client.ClientRequest) returns (stream arbiter.client.ClientResponse);
rpc Operator(stream arbiter.operator.OperatorRequest) returns (stream arbiter.operator.OperatorResponse); rpc UserAgent(stream arbiter.user_agent.UserAgentRequest) returns (stream arbiter.user_agent.UserAgentResponse);
} }

50
protobufs/client.proto
View File

@@ -1,25 +1,25 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.client; package arbiter.client;
import "client/auth.proto"; import "client/auth.proto";
import "client/evm.proto"; import "client/evm.proto";
import "client/vault.proto"; import "client/vault.proto";
message ClientRequest { message ClientRequest {
int32 request_id = 4; int32 request_id = 4;
oneof payload { oneof payload {
auth.Request auth = 1; auth.Request auth = 1;
vault.Request vault = 2; vault.Request vault = 2;
evm.Request evm = 3; evm.Request evm = 3;
} }
} }
message ClientResponse { message ClientResponse {
optional int32 request_id = 7; optional int32 request_id = 7;
oneof payload { oneof payload {
auth.Response auth = 1; auth.Response auth = 1;
vault.Response vault = 2; vault.Response vault = 2;
evm.Response evm = 3; evm.Response evm = 3;
} }
} }

86
protobufs/client/auth.proto
View File

@@ -1,43 +1,43 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.client.auth; package arbiter.client.auth;
import "shared/client.proto"; import "shared/client.proto";
message AuthChallengeRequest { message AuthChallengeRequest {
bytes pubkey = 1; bytes pubkey = 1;
arbiter.shared.ClientInfo client_info = 2; arbiter.shared.ClientInfo client_info = 2;
} }
message AuthChallenge { message AuthChallenge {
uint64 timestamp_nanos = 1; bytes pubkey = 1;
bytes random = 2; int32 nonce = 2;
} }
message AuthChallengeSolution { message AuthChallengeSolution {
bytes signature = 1; bytes signature = 1;
} }
enum AuthResult { enum AuthResult {
AUTH_RESULT_UNSPECIFIED = 0; AUTH_RESULT_UNSPECIFIED = 0;
AUTH_RESULT_SUCCESS = 1; AUTH_RESULT_SUCCESS = 1;
AUTH_RESULT_INVALID_KEY = 2; AUTH_RESULT_INVALID_KEY = 2;
AUTH_RESULT_INVALID_SIGNATURE = 3; AUTH_RESULT_INVALID_SIGNATURE = 3;
AUTH_RESULT_APPROVAL_DENIED = 4; AUTH_RESULT_APPROVAL_DENIED = 4;
AUTH_RESULT_NO_OPERATORS_ONLINE = 5; AUTH_RESULT_NO_USER_AGENTS_ONLINE = 5;
AUTH_RESULT_INTERNAL = 6; AUTH_RESULT_INTERNAL = 6;
} }
message Request { message Request {
oneof payload { oneof payload {
AuthChallengeRequest challenge_request = 1; AuthChallengeRequest challenge_request = 1;
AuthChallengeSolution challenge_solution = 2; AuthChallengeSolution challenge_solution = 2;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
AuthChallenge challenge = 1; AuthChallenge challenge = 1;
AuthResult result = 2; AuthResult result = 2;
} }
} }

38
protobufs/client/evm.proto
View File

@@ -1,19 +1,19 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.client.evm; package arbiter.client.evm;
import "evm.proto"; import "evm.proto";
message Request { message Request {
oneof payload { oneof payload {
arbiter.evm.EvmSignTransactionRequest sign_transaction = 1; arbiter.evm.EvmSignTransactionRequest sign_transaction = 1;
arbiter.evm.EvmAnalyzeTransactionRequest analyze_transaction = 2; arbiter.evm.EvmAnalyzeTransactionRequest analyze_transaction = 2;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
arbiter.evm.EvmSignTransactionResponse sign_transaction = 1; arbiter.evm.EvmSignTransactionResponse sign_transaction = 1;
arbiter.evm.EvmAnalyzeTransactionResponse analyze_transaction = 2; arbiter.evm.EvmAnalyzeTransactionResponse analyze_transaction = 2;
} }
} }

36
protobufs/client/vault.proto
View File

@@ -1,18 +1,18 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.client.vault; package arbiter.client.vault;
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
import "shared/vault.proto"; import "shared/vault.proto";
message Request { message Request {
oneof payload { oneof payload {
google.protobuf.Empty query_state = 1; google.protobuf.Empty query_state = 1;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
arbiter.shared.VaultState state = 1; arbiter.shared.VaultState state = 1;
} }
} }

306
protobufs/evm.proto
View File

@@ -1,153 +1,153 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.evm; package arbiter.evm;
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto"; import "google/protobuf/timestamp.proto";
import "shared/evm.proto"; import "shared/evm.proto";
enum EvmError { enum EvmError {
EVM_ERROR_UNSPECIFIED = 0; EVM_ERROR_UNSPECIFIED = 0;
EVM_ERROR_VAULT_SEALED = 1; EVM_ERROR_VAULT_SEALED = 1;
EVM_ERROR_INTERNAL = 2; EVM_ERROR_INTERNAL = 2;
} }
message WalletEntry { message WalletEntry {
int32 id = 1; int32 id = 1;
bytes address = 2; // 20-byte Ethereum address bytes address = 2; // 20-byte Ethereum address
} }
message WalletList { message WalletList {
repeated WalletEntry wallets = 1; repeated WalletEntry wallets = 1;
} }
message WalletCreateResponse { message WalletCreateResponse {
oneof result { oneof result {
WalletEntry wallet = 1; WalletEntry wallet = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
message WalletListResponse { message WalletListResponse {
oneof result { oneof result {
WalletList wallets = 1; WalletList wallets = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
// --- Grant types --- // --- Grant types ---
message TransactionRateLimit { message TransactionRateLimit {
uint32 count = 1; uint32 count = 1;
int64 window_secs = 2; int64 window_secs = 2;
} }
message VolumeRateLimit { message VolumeRateLimit {
bytes max_volume = 1; // U256 as big-endian bytes bytes max_volume = 1; // U256 as big-endian bytes
int64 window_secs = 2; int64 window_secs = 2;
} }
message SharedSettings { message SharedSettings {
int32 wallet_access_id = 1; int32 wallet_access_id = 1;
uint64 chain_id = 2; uint64 chain_id = 2;
optional google.protobuf.Timestamp valid_from = 3; optional google.protobuf.Timestamp valid_from = 3;
optional google.protobuf.Timestamp valid_until = 4; optional google.protobuf.Timestamp valid_until = 4;
optional bytes max_gas_fee_per_gas = 5; // U256 as big-endian bytes optional bytes max_gas_fee_per_gas = 5; // U256 as big-endian bytes
optional bytes max_priority_fee_per_gas = 6; // U256 as big-endian bytes optional bytes max_priority_fee_per_gas = 6; // U256 as big-endian bytes
optional TransactionRateLimit rate_limit = 7; optional TransactionRateLimit rate_limit = 7;
} }
message EtherTransferSettings { message EtherTransferSettings {
repeated bytes targets = 1; // list of 20-byte Ethereum addresses repeated bytes targets = 1; // list of 20-byte Ethereum addresses
VolumeRateLimit limit = 2; VolumeRateLimit limit = 2;
} }
message TokenTransferSettings { message TokenTransferSettings {
bytes token_contract = 1; // 20-byte Ethereum address bytes token_contract = 1; // 20-byte Ethereum address
optional bytes target = 2; // 20-byte Ethereum address; absent means any recipient allowed optional bytes target = 2; // 20-byte Ethereum address; absent means any recipient allowed
repeated VolumeRateLimit volume_limits = 3; repeated VolumeRateLimit volume_limits = 3;
} }
message SpecificGrant { message SpecificGrant {
oneof grant { oneof grant {
EtherTransferSettings ether_transfer = 1; EtherTransferSettings ether_transfer = 1;
TokenTransferSettings token_transfer = 2; TokenTransferSettings token_transfer = 2;
} }
} }
// --- Operator grant management --- // --- UserAgent grant management ---
message EvmGrantCreateRequest { message EvmGrantCreateRequest {
SharedSettings shared = 1; SharedSettings shared = 1;
SpecificGrant specific = 2; SpecificGrant specific = 2;
} }
message EvmGrantCreateResponse { message EvmGrantCreateResponse {
oneof result { oneof result {
int32 grant_id = 1; int32 grant_id = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
message EvmGrantDeleteRequest { message EvmGrantDeleteRequest {
int32 grant_id = 1; int32 grant_id = 1;
} }
message EvmGrantDeleteResponse { message EvmGrantDeleteResponse {
oneof result { oneof result {
google.protobuf.Empty ok = 1; google.protobuf.Empty ok = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
// Basic grant info returned in grant listings // Basic grant info returned in grant listings
message GrantEntry { message GrantEntry {
int32 id = 1; int32 id = 1;
int32 wallet_access_id = 2; int32 wallet_access_id = 2;
SharedSettings shared = 3; SharedSettings shared = 3;
SpecificGrant specific = 4; SpecificGrant specific = 4;
} }
message EvmGrantListRequest { message EvmGrantListRequest {
optional int32 wallet_access_id = 1; optional int32 wallet_access_id = 1;
} }
message EvmGrantListResponse { message EvmGrantListResponse {
oneof result { oneof result {
EvmGrantList grants = 1; EvmGrantList grants = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
message EvmGrantList { message EvmGrantList {
repeated GrantEntry grants = 1; repeated GrantEntry grants = 1;
} }
// --- Client transaction operations --- // --- Client transaction operations ---
message EvmSignTransactionRequest { message EvmSignTransactionRequest {
bytes wallet_address = 1; // 20-byte Ethereum address bytes wallet_address = 1; // 20-byte Ethereum address
bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction (unsigned) bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction (unsigned)
} }
// oneof because signing and evaluation happen atomically — a signing failure // oneof because signing and evaluation happen atomically — a signing failure
// is always either an eval error or an internal error, never a partial success // is always either an eval error or an internal error, never a partial success
message EvmSignTransactionResponse { message EvmSignTransactionResponse {
oneof result { oneof result {
bytes signature = 1; // 65-byte signature: r[32] || s[32] || v[1] bytes signature = 1; // 65-byte signature: r[32] || s[32] || v[1]
arbiter.shared.evm.TransactionEvalError eval_error = 2; arbiter.shared.evm.TransactionEvalError eval_error = 2;
EvmError error = 3; EvmError error = 3;
} }
} }
message EvmAnalyzeTransactionRequest { message EvmAnalyzeTransactionRequest {
bytes wallet_address = 1; // 20-byte Ethereum address bytes wallet_address = 1; // 20-byte Ethereum address
bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction
} }
message EvmAnalyzeTransactionResponse { message EvmAnalyzeTransactionResponse {
oneof result { oneof result {
arbiter.shared.evm.SpecificMeaning meaning = 1; arbiter.shared.evm.SpecificMeaning meaning = 1;
arbiter.shared.evm.TransactionEvalError eval_error = 2; arbiter.shared.evm.TransactionEvalError eval_error = 2;
EvmError error = 3; EvmError error = 3;
} }
} }

18
protobufs/shared/client.proto
View File

@@ -1,9 +1,9 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.shared; package arbiter.shared;
message ClientInfo { message ClientInfo {
string name = 1; string name = 1;
optional string description = 2; optional string description = 2;
optional string version = 3; optional string version = 3;
} }

142
protobufs/shared/evm.proto
View File

@@ -1,74 +1,68 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.shared.evm; package arbiter.shared.evm;
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
message EtherTransferMeaning { message EtherTransferMeaning {
bytes to = 1; // 20-byte Ethereum address bytes to = 1; // 20-byte Ethereum address
bytes value = 2; // U256 as big-endian bytes bytes value = 2; // U256 as big-endian bytes
} }
message TokenInfo { message TokenInfo {
string symbol = 1; string symbol = 1;
bytes address = 2; // 20-byte Ethereum address bytes address = 2; // 20-byte Ethereum address
uint64 chain_id = 3; uint64 chain_id = 3;
} }
// Mirror of token_transfers::Meaning // Mirror of token_transfers::Meaning
message TokenTransferMeaning { message TokenTransferMeaning {
TokenInfo token = 1; TokenInfo token = 1;
bytes to = 2; // 20-byte Ethereum address bytes to = 2; // 20-byte Ethereum address
bytes value = 3; // U256 as big-endian bytes bytes value = 3; // U256 as big-endian bytes
} }
// Mirror of policies::SpecificMeaning // Mirror of policies::SpecificMeaning
message SpecificMeaning { message SpecificMeaning {
oneof meaning { oneof meaning {
EtherTransferMeaning ether_transfer = 1; EtherTransferMeaning ether_transfer = 1;
TokenTransferMeaning token_transfer = 2; TokenTransferMeaning token_transfer = 2;
} }
} }
message GasLimitExceededViolation { message GasLimitExceededViolation {
optional bytes max_gas_fee_per_gas = 1; // U256 as big-endian bytes optional bytes max_gas_fee_per_gas = 1; // U256 as big-endian bytes
optional bytes max_priority_fee_per_gas = 2; // U256 as big-endian bytes optional bytes max_priority_fee_per_gas = 2; // U256 as big-endian bytes
} }
message EvalViolation { message EvalViolation {
message ChainIdMismatch { oneof kind {
uint64 expected = 1; bytes invalid_target = 1; // 20-byte Ethereum address
uint64 actual = 2; GasLimitExceededViolation gas_limit_exceeded = 2;
} google.protobuf.Empty rate_limit_exceeded = 3;
oneof kind { google.protobuf.Empty volumetric_limit_exceeded = 4;
bytes invalid_target = 1; // 20-byte Ethereum address google.protobuf.Empty invalid_time = 5;
GasLimitExceededViolation gas_limit_exceeded = 2; google.protobuf.Empty invalid_transaction_type = 6;
google.protobuf.Empty rate_limit_exceeded = 3; }
google.protobuf.Empty volumetric_limit_exceeded = 4; }
google.protobuf.Empty invalid_time = 5;
google.protobuf.Empty invalid_transaction_type = 6; // Transaction was classified but no grant covers it
message NoMatchingGrantError {
ChainIdMismatch chain_id_mismatch = 7; SpecificMeaning meaning = 1;
} }
}
// Transaction was classified and a grant was found, but constraints were violated
// Transaction was classified but no grant covers it message PolicyViolationsError {
message NoMatchingGrantError { SpecificMeaning meaning = 1;
SpecificMeaning meaning = 1; repeated EvalViolation violations = 2;
} }
// Transaction was classified and a grant was found, but constraints were violated // top-level error returned when transaction evaluation fails
message PolicyViolationsError { message TransactionEvalError {
SpecificMeaning meaning = 1; oneof kind {
repeated EvalViolation violations = 2; google.protobuf.Empty contract_creation_not_supported = 1;
} google.protobuf.Empty unsupported_transaction_type = 2;
NoMatchingGrantError no_matching_grant = 3;
// top-level error returned when transaction evaluation fails PolicyViolationsError policy_violations = 4;
message TransactionEvalError { }
oneof kind { }
google.protobuf.Empty contract_creation_not_supported = 1;
google.protobuf.Empty unsupported_transaction_type = 2;
NoMatchingGrantError no_matching_grant = 3;
PolicyViolationsError policy_violations = 4;
}
}

22
protobufs/shared/vault.proto
View File

@@ -1,11 +1,11 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.shared; package arbiter.shared;
enum VaultState { enum VaultState {
VAULT_STATE_UNSPECIFIED = 0; VAULT_STATE_UNSPECIFIED = 0;
VAULT_STATE_UNBOOTSTRAPPED = 1; VAULT_STATE_UNBOOTSTRAPPED = 1;
VAULT_STATE_SEALED = 2; VAULT_STATE_SEALED = 2;
VAULT_STATE_UNSEALED = 3; VAULT_STATE_UNSEALED = 3;
VAULT_STATE_ERROR = 4; VAULT_STATE_ERROR = 4;
} }

56
protobufs/operator.proto → protobufs/user_agent.proto
View File

@@ -1,28 +1,28 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator; package arbiter.user_agent;
import "operator/auth.proto"; import "user_agent/auth.proto";
import "operator/evm.proto"; import "user_agent/evm.proto";
import "operator/sdk_client.proto"; import "user_agent/sdk_client.proto";
import "operator/vault/vault.proto"; import "user_agent/vault/vault.proto";
message OperatorRequest { message UserAgentRequest {
int32 id = 16; int32 id = 16;
oneof payload { oneof payload {
auth.Request auth = 1; auth.Request auth = 1;
vault.Request vault = 2; vault.Request vault = 2;
evm.Request evm = 3; evm.Request evm = 3;
sdk_client.Request sdk_client = 4; sdk_client.Request sdk_client = 4;
} }
} }
message OperatorResponse { message UserAgentResponse {
optional int32 id = 16; optional int32 id = 16;
oneof payload { oneof payload {
auth.Response auth = 1; auth.Response auth = 1;
vault.Response vault = 2; vault.Response vault = 2;
evm.Response evm = 3; evm.Response evm = 3;
sdk_client.Response sdk_client = 4; sdk_client.Response sdk_client = 4;
} }
} }

89
protobufs/operator/auth.proto → protobufs/user_agent/auth.proto
View File

@@ -1,41 +1,48 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.auth; package arbiter.user_agent.auth;
message AuthChallengeRequest { enum KeyType {
bytes pubkey = 1; KEY_TYPE_UNSPECIFIED = 0;
optional string bootstrap_token = 2; KEY_TYPE_ED25519 = 1;
} KEY_TYPE_ECDSA_SECP256K1 = 2;
KEY_TYPE_RSA = 3;
message AuthChallenge { }
uint64 timestamp_nanos = 1;
bytes random = 2; message AuthChallengeRequest {
} bytes pubkey = 1;
optional string bootstrap_token = 2;
message AuthChallengeSolution { KeyType key_type = 3;
bytes signature = 1; }
}
message AuthChallenge {
enum AuthResult { int32 nonce = 1;
AUTH_RESULT_UNSPECIFIED = 0; }
AUTH_RESULT_SUCCESS = 1;
AUTH_RESULT_INVALID_KEY = 2; message AuthChallengeSolution {
AUTH_RESULT_INVALID_SIGNATURE = 3; bytes signature = 1;
AUTH_RESULT_BOOTSTRAP_REQUIRED = 4; }
AUTH_RESULT_TOKEN_INVALID = 5;
AUTH_RESULT_INTERNAL = 6; enum AuthResult {
} AUTH_RESULT_UNSPECIFIED = 0;
AUTH_RESULT_SUCCESS = 1;
message Request { AUTH_RESULT_INVALID_KEY = 2;
oneof payload { AUTH_RESULT_INVALID_SIGNATURE = 3;
AuthChallengeRequest challenge_request = 1; AUTH_RESULT_BOOTSTRAP_REQUIRED = 4;
AuthChallengeSolution challenge_solution = 2; AUTH_RESULT_TOKEN_INVALID = 5;
} AUTH_RESULT_INTERNAL = 6;
} }
message Response { message Request {
oneof payload { oneof payload {
AuthChallenge challenge = 1; AuthChallengeRequest challenge_request = 1;
AuthResult result = 2; AuthChallengeSolution challenge_solution = 2;
} }
} }
message Response {
oneof payload {
AuthChallenge challenge = 1;
AuthResult result = 2;
}
}

66
protobufs/operator/evm.proto → protobufs/user_agent/evm.proto
View File

@@ -1,33 +1,33 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.evm; package arbiter.user_agent.evm;
import "evm.proto"; import "evm.proto";
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
message SignTransactionRequest { message SignTransactionRequest {
int32 client_id = 1; int32 client_id = 1;
arbiter.evm.EvmSignTransactionRequest request = 2; arbiter.evm.EvmSignTransactionRequest request = 2;
} }
message Request { message Request {
oneof payload { oneof payload {
google.protobuf.Empty wallet_create = 1; google.protobuf.Empty wallet_create = 1;
google.protobuf.Empty wallet_list = 2; google.protobuf.Empty wallet_list = 2;
arbiter.evm.EvmGrantCreateRequest grant_create = 3; arbiter.evm.EvmGrantCreateRequest grant_create = 3;
arbiter.evm.EvmGrantDeleteRequest grant_delete = 4; arbiter.evm.EvmGrantDeleteRequest grant_delete = 4;
arbiter.evm.EvmGrantListRequest grant_list = 5; arbiter.evm.EvmGrantListRequest grant_list = 5;
SignTransactionRequest sign_transaction = 6; SignTransactionRequest sign_transaction = 6;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
arbiter.evm.WalletCreateResponse wallet_create = 1; arbiter.evm.WalletCreateResponse wallet_create = 1;
arbiter.evm.WalletListResponse wallet_list = 2; arbiter.evm.WalletListResponse wallet_list = 2;
arbiter.evm.EvmGrantCreateResponse grant_create = 3; arbiter.evm.EvmGrantCreateResponse grant_create = 3;
arbiter.evm.EvmGrantDeleteResponse grant_delete = 4; arbiter.evm.EvmGrantDeleteResponse grant_delete = 4;
arbiter.evm.EvmGrantListResponse grant_list = 5; arbiter.evm.EvmGrantListResponse grant_list = 5;
arbiter.evm.EvmSignTransactionResponse sign_transaction = 6; arbiter.evm.EvmSignTransactionResponse sign_transaction = 6;
} }
} }

200
protobufs/operator/sdk_client.proto → protobufs/user_agent/sdk_client.proto
View File

@@ -1,100 +1,100 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.sdk_client; package arbiter.user_agent.sdk_client;
import "shared/client.proto"; import "shared/client.proto";
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
enum Error { enum Error {
ERROR_UNSPECIFIED = 0; ERROR_UNSPECIFIED = 0;
ERROR_ALREADY_EXISTS = 1; ERROR_ALREADY_EXISTS = 1;
ERROR_NOT_FOUND = 2; ERROR_NOT_FOUND = 2;
ERROR_HAS_RELATED_DATA = 3; // hard-delete blocked by FK (client has grants or transaction logs) ERROR_HAS_RELATED_DATA = 3; // hard-delete blocked by FK (client has grants or transaction logs)
ERROR_INTERNAL = 4; ERROR_INTERNAL = 4;
} }
message RevokeRequest { message RevokeRequest {
int32 client_id = 1; int32 client_id = 1;
} }
message Entry { message Entry {
int32 id = 1; int32 id = 1;
bytes pubkey = 2; bytes pubkey = 2;
arbiter.shared.ClientInfo info = 3; arbiter.shared.ClientInfo info = 3;
int32 created_at = 4; int32 created_at = 4;
} }
message List { message List {
repeated Entry clients = 1; repeated Entry clients = 1;
} }
message RevokeResponse { message RevokeResponse {
oneof result { oneof result {
google.protobuf.Empty ok = 1; google.protobuf.Empty ok = 1;
Error error = 2; Error error = 2;
} }
} }
message ListResponse { message ListResponse {
oneof result { oneof result {
List clients = 1; List clients = 1;
Error error = 2; Error error = 2;
} }
} }
message ConnectionRequest { message ConnectionRequest {
bytes pubkey = 1; bytes pubkey = 1;
arbiter.shared.ClientInfo info = 2; arbiter.shared.ClientInfo info = 2;
} }
message ConnectionResponse { message ConnectionResponse {
bool approved = 1; bool approved = 1;
bytes pubkey = 2; bytes pubkey = 2;
} }
message ConnectionCancel { message ConnectionCancel {
bytes pubkey = 1; bytes pubkey = 1;
} }
message WalletAccess { message WalletAccess {
int32 wallet_id = 1; int32 wallet_id = 1;
int32 sdk_client_id = 2; int32 sdk_client_id = 2;
} }
message WalletAccessEntry { message WalletAccessEntry {
int32 id = 1; int32 id = 1;
WalletAccess access = 2; WalletAccess access = 2;
} }
message GrantWalletAccess { message GrantWalletAccess {
repeated WalletAccess accesses = 1; repeated WalletAccess accesses = 1;
} }
message RevokeWalletAccess { message RevokeWalletAccess {
repeated int32 accesses = 1; repeated int32 accesses = 1;
} }
message ListWalletAccessResponse { message ListWalletAccessResponse {
repeated WalletAccessEntry accesses = 1; repeated WalletAccessEntry accesses = 1;
} }
message Request { message Request {
oneof payload { oneof payload {
ConnectionResponse connection_response = 1; ConnectionResponse connection_response = 1;
RevokeRequest revoke = 2; RevokeRequest revoke = 2;
google.protobuf.Empty list = 3; google.protobuf.Empty list = 3;
GrantWalletAccess grant_wallet_access = 4; GrantWalletAccess grant_wallet_access = 4;
RevokeWalletAccess revoke_wallet_access = 5; RevokeWalletAccess revoke_wallet_access = 5;
google.protobuf.Empty list_wallet_access = 6; google.protobuf.Empty list_wallet_access = 6;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
ConnectionRequest connection_request = 1; ConnectionRequest connection_request = 1;
ConnectionCancel connection_cancel = 2; ConnectionCancel connection_cancel = 2;
RevokeResponse revoke = 3; RevokeResponse revoke = 3;
ListResponse list = 4; ListResponse list = 4;
ListWalletAccessResponse list_wallet_access = 5; ListWalletAccessResponse list_wallet_access = 5;
} }
} }

48
protobufs/operator/vault/bootstrap.proto → protobufs/user_agent/vault/bootstrap.proto
View File

@@ -1,24 +1,24 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.vault.bootstrap; package arbiter.user_agent.vault.bootstrap;
message BootstrapEncryptedKey { message BootstrapEncryptedKey {
bytes nonce = 1; bytes nonce = 1;
bytes ciphertext = 2; bytes ciphertext = 2;
bytes associated_data = 3; bytes associated_data = 3;
} }
enum BootstrapResult { enum BootstrapResult {
BOOTSTRAP_RESULT_UNSPECIFIED = 0; BOOTSTRAP_RESULT_UNSPECIFIED = 0;
BOOTSTRAP_RESULT_SUCCESS = 1; BOOTSTRAP_RESULT_SUCCESS = 1;
BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2; BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
BOOTSTRAP_RESULT_INVALID_KEY = 3; BOOTSTRAP_RESULT_INVALID_KEY = 3;
} }
message Request { message Request {
BootstrapEncryptedKey encrypted_key = 2; BootstrapEncryptedKey encrypted_key = 2;
} }
message Response { message Response {
BootstrapResult result = 1; BootstrapResult result = 1;
} }

74
protobufs/operator/vault/unseal.proto → protobufs/user_agent/vault/unseal.proto
View File

@@ -1,37 +1,37 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.vault.unseal; package arbiter.user_agent.vault.unseal;
message UnsealStart { message UnsealStart {
bytes client_pubkey = 1; bytes client_pubkey = 1;
} }
message UnsealStartResponse { message UnsealStartResponse {
bytes server_pubkey = 1; bytes server_pubkey = 1;
} }
message UnsealEncryptedKey { message UnsealEncryptedKey {
bytes nonce = 1; bytes nonce = 1;
bytes ciphertext = 2; bytes ciphertext = 2;
bytes associated_data = 3; bytes associated_data = 3;
} }
enum UnsealResult { enum UnsealResult {
UNSEAL_RESULT_UNSPECIFIED = 0; UNSEAL_RESULT_UNSPECIFIED = 0;
UNSEAL_RESULT_SUCCESS = 1; UNSEAL_RESULT_SUCCESS = 1;
UNSEAL_RESULT_INVALID_KEY = 2; UNSEAL_RESULT_INVALID_KEY = 2;
UNSEAL_RESULT_UNBOOTSTRAPPED = 3; UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
} }
message Request { message Request {
oneof payload { oneof payload {
UnsealStart start = 1; UnsealStart start = 1;
UnsealEncryptedKey encrypted_key = 2; UnsealEncryptedKey encrypted_key = 2;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
UnsealStartResponse start = 1; UnsealStartResponse start = 1;
UnsealResult result = 2; UnsealResult result = 2;
} }
} }

48
protobufs/operator/vault/vault.proto → protobufs/user_agent/vault/vault.proto
View File

@@ -1,24 +1,24 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.vault; package arbiter.user_agent.vault;
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
import "shared/vault.proto"; import "shared/vault.proto";
import "operator/vault/bootstrap.proto"; import "user_agent/vault/bootstrap.proto";
import "operator/vault/unseal.proto"; import "user_agent/vault/unseal.proto";
message Request { message Request {
oneof payload { oneof payload {
google.protobuf.Empty query_state = 1; google.protobuf.Empty query_state = 1;
unseal.Request unseal = 2; unseal.Request unseal = 2;
bootstrap.Request bootstrap = 3; bootstrap.Request bootstrap = 3;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
arbiter.shared.VaultState state = 1; arbiter.shared.VaultState state = 1;
unseal.Response unseal = 2; unseal.Response unseal = 2;
bootstrap.Response bootstrap = 3; bootstrap.Response bootstrap = 3;
} }
} }

300
scripts/gen_erc20_registry.py
View File

@@ -1,150 +1,150 @@
#!/usr/bin/env python3 #!/usr/bin/env python3
""" """
Fetch the Uniswap default token list and emit Rust `TokenInfo` statics. Fetch the Uniswap default token list and emit Rust `TokenInfo` statics.
Usage: Usage:
python3 gen_erc20_registry.py # fetch from IPFS python3 gen_erc20_registry.py # fetch from IPFS
python3 gen_erc20_registry.py tokens.json # local file python3 gen_erc20_registry.py tokens.json # local file
python3 gen_erc20_registry.py tokens.json out.rs # custom output file python3 gen_erc20_registry.py tokens.json out.rs # custom output file
""" """
import json import json
import re import re
import sys import sys
import unicodedata import unicodedata
import urllib.request import urllib.request
UNISWAP_URL = "https://ipfs.io/ipns/tokens.uniswap.org" UNISWAP_URL = "https://ipfs.io/ipns/tokens.uniswap.org"
SOLANA_CHAIN_ID = 501000101 SOLANA_CHAIN_ID = 501000101
IDENTIFIER_RE = re.compile(r"[^A-Za-z0-9]+") IDENTIFIER_RE = re.compile(r"[^A-Za-z0-9]+")
def load_tokens(source=None): def load_tokens(source=None):
if source: if source:
with open(source) as f: with open(source) as f:
return json.load(f) return json.load(f)
req = urllib.request.Request( req = urllib.request.Request(
UNISWAP_URL, UNISWAP_URL,
headers={"Accept": "application/json", "User-Agent": "gen_tokens/1.0"}, headers={"Accept": "application/json", "User-Agent": "gen_tokens/1.0"},
) )
with urllib.request.urlopen(req, timeout=60) as resp: with urllib.request.urlopen(req, timeout=60) as resp:
return json.loads(resp.read()) return json.loads(resp.read())
def escape(s: str) -> str: def escape(s: str) -> str:
return s.replace("\\", "\\\\").replace('"', '\\"') return s.replace("\\", "\\\\").replace('"', '\\"')
def to_screaming_case(name: str) -> str: def to_screaming_case(name: str) -> str:
normalized = unicodedata.normalize("NFKD", name or "") normalized = unicodedata.normalize("NFKD", name or "")
ascii_name = normalized.encode("ascii", "ignore").decode("ascii") ascii_name = normalized.encode("ascii", "ignore").decode("ascii")
snake = IDENTIFIER_RE.sub("_", ascii_name).strip("_").upper() snake = IDENTIFIER_RE.sub("_", ascii_name).strip("_").upper()
if not snake: if not snake:
snake = "TOKEN" snake = "TOKEN"
if snake[0].isdigit(): if snake[0].isdigit():
snake = f"TOKEN_{snake}" snake = f"TOKEN_{snake}"
return snake return snake
def static_name_for_token(token: dict, used_names: set[str]) -> str: def static_name_for_token(token: dict, used_names: set[str]) -> str:
base = to_screaming_case(token.get("name", "")) base = to_screaming_case(token.get("name", ""))
if base not in used_names: if base not in used_names:
used_names.add(base) used_names.add(base)
return base return base
address = token["address"] address = token["address"]
suffix = f"{token['chainId']}_{address[2:].upper()[-8:]}" suffix = f"{token['chainId']}_{address[2:].upper()[-8:]}"
candidate = f"{base}_{suffix}" candidate = f"{base}_{suffix}"
i = 2 i = 2
while candidate in used_names: while candidate in used_names:
candidate = f"{base}_{suffix}_{i}" candidate = f"{base}_{suffix}_{i}"
i += 1 i += 1
used_names.add(candidate) used_names.add(candidate)
return candidate return candidate
def main(): def main():
source = sys.argv[1] if len(sys.argv) > 1 else None source = sys.argv[1] if len(sys.argv) > 1 else None
output = sys.argv[2] if len(sys.argv) > 2 else "generated_tokens.rs" output = sys.argv[2] if len(sys.argv) > 2 else "generated_tokens.rs"
data = load_tokens(source) data = load_tokens(source)
tokens = data["tokens"] tokens = data["tokens"]
# Deduplicate by (chainId, address) # Deduplicate by (chainId, address)
seen = set() seen = set()
unique = [] unique = []
for t in tokens: for t in tokens:
key = (t["chainId"], t["address"].lower()) key = (t["chainId"], t["address"].lower())
if key not in seen: if key not in seen:
seen.add(key) seen.add(key)
unique.append(t) unique.append(t)
unique.sort(key=lambda t: (t["chainId"], t.get("symbol", "").upper())) unique.sort(key=lambda t: (t["chainId"], t.get("symbol", "").upper()))
evm_tokens = [t for t in unique if t["chainId"] != SOLANA_CHAIN_ID] evm_tokens = [t for t in unique if t["chainId"] != SOLANA_CHAIN_ID]
ver = data["version"] ver = data["version"]
lines = [] lines = []
w = lines.append w = lines.append
w( w(
f"// Auto-generated from Uniswap token list v{ver['major']}.{ver['minor']}.{ver['patch']}" f"// Auto-generated from Uniswap token list v{ver['major']}.{ver['minor']}.{ver['patch']}"
) )
w(f"// {len(evm_tokens)} tokens") w(f"// {len(evm_tokens)} tokens")
w("// DO NOT EDIT - regenerate with gen_erc20_registry.py") w("// DO NOT EDIT - regenerate with gen_erc20_registry.py")
w("") w("")
used_static_names = set() used_static_names = set()
token_statics = [] token_statics = []
for t in evm_tokens: for t in evm_tokens:
static_name = static_name_for_token(t, used_static_names) static_name = static_name_for_token(t, used_static_names)
token_statics.append((static_name, t)) token_statics.append((static_name, t))
for static_name, t in token_statics: for static_name, t in token_statics:
addr = t["address"] addr = t["address"]
name = escape(t.get("name", "")) name = escape(t.get("name", ""))
symbol = escape(t.get("symbol", "")) symbol = escape(t.get("symbol", ""))
decimals = t.get("decimals", 18) decimals = t.get("decimals", 18)
logo = t.get("logoURI") logo = t.get("logoURI")
chain = t["chainId"] chain = t["chainId"]
logo_val = f'Some("{escape(logo)}")' if logo else "None" logo_val = f'Some("{escape(logo)}")' if logo else "None"
w(f"pub static {static_name}: TokenInfo = TokenInfo {{") w(f"pub static {static_name}: TokenInfo = TokenInfo {{")
w(f' name: "{name}",') w(f' name: "{name}",')
w(f' symbol: "{symbol}",') w(f' symbol: "{symbol}",')
w(f" decimals: {decimals},") w(f" decimals: {decimals},")
w(f' contract: address!("{addr}"),') w(f' contract: address!("{addr}"),')
w(f" chain: {chain},") w(f" chain: {chain},")
w(f" logo_uri: {logo_val},") w(f" logo_uri: {logo_val},")
w("};") w("};")
w("") w("")
w("pub static TOKENS: &[&TokenInfo] = &[") w("pub static TOKENS: &[&TokenInfo] = &[")
for static_name, _ in token_statics: for static_name, _ in token_statics:
w(f" &{static_name},") w(f" &{static_name},")
w("];") w("];")
w("") w("")
w("pub fn get_token(") w("pub fn get_token(")
w(" chain_id: alloy::primitives::ChainId,") w(" chain_id: alloy::primitives::ChainId,")
w(" address: alloy::primitives::Address,") w(" address: alloy::primitives::Address,")
w(") -> Option<&'static TokenInfo> {") w(") -> Option<&'static TokenInfo> {")
w(" match (chain_id, address) {") w(" match (chain_id, address) {")
for static_name, t in token_statics: for static_name, t in token_statics:
w( w(
f' ({t["chainId"]}, addr) if addr == address!("{t["address"]}") => Some(&{static_name}),' f' ({t["chainId"]}, addr) if addr == address!("{t["address"]}") => Some(&{static_name}),'
) )
w(" _ => None,") w(" _ => None,")
w(" }") w(" }")
w("}") w("}")
w("") w("")
with open(output, "w") as f: with open(output, "w") as f:
f.write("\n".join(lines)) f.write("\n".join(lines))
print(f"Wrote {len(token_statics)} tokens to {output}") print(f"Wrote {len(token_statics)} tokens to {output}")
if __name__ == "__main__": if __name__ == "__main__":
main() main()

26
server/.cargo/audit.toml
View File

@@ -1,13 +1,13 @@
[advisories] [advisories]
# RUSTSEC-2023-0071: Marvin Attack timing side-channel in rsa crate. # RUSTSEC-2023-0071: Marvin Attack timing side-channel in rsa crate.
# No fixed version is available upstream. # No fixed version is available upstream.
# RSA support is required for Windows Hello / KeyCredentialManager # RSA support is required for Windows Hello / KeyCredentialManager
# (https://learn.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager.requestcreateasync), # (https://learn.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager.requestcreateasync),
# which only issues RSA-2048 keys. # which only issues RSA-2048 keys.
# Mitigations in place: # Mitigations in place:
# - Signing uses BlindedSigningKey (PSS+SHA-256), which applies blinding to # - Signing uses BlindedSigningKey (PSS+SHA-256), which applies blinding to
# protect the private key from timing recovery during signing. # protect the private key from timing recovery during signing.
# - RSA decryption is never performed; we only verify public-key signatures. # - RSA decryption is never performed; we only verify public-key signatures.
# - The attack requires local, high-resolution timing access against the # - The attack requires local, high-resolution timing access against the
# signing process, which is not exposed in our threat model. # signing process, which is not exposed in our threat model.
ignore = ["RUSTSEC-2023-0071"] ignore = ["RUSTSEC-2023-0071"]

2
server/.cargo/config.toml
View File

@@ -1,2 +0,0 @@
[env]
MACOSX_DEPLOYMENT_TARGET = "26.3"

1
server/.cargo/mutants.toml
View File

@@ -1 +0,0 @@
test_tool = "nextest"

2
server/.gitignore vendored
View File

@@ -1,2 +0,0 @@
mutants.out/
mutants.out.old/

12664
server/Cargo.lock generated
View File

File diff suppressed because it is too large Load Diff

217
server/Cargo.toml
View File

@@ -1,171 +1,46 @@
[workspace] [workspace]
members = [ members = [
"crates/*", "crates/*",
] ]
resolver = "3" resolver = "3"
[workspace.lints.clippy]
[workspace.dependencies] disallowed-methods = "deny"
alloy = "2.0.4"
async-trait = "0.1.89"
base64 = "0.22.1" [workspace.dependencies]
chrono = { version = "0.4.44", features = ["serde"] } tonic = { version = "0.14.5", features = [
futures = "0.3.32" "deflate",
k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] } "gzip",
kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"} "tls-connect-info",
kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"} "zstd",
hmac = "0.13.0" ] }
miette = { version = "7.6.0", features = ["fancy", "serde"] } tracing = "0.1.44"
ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] } tokio = { version = "1.50.0", features = ["full"] }
mutants = "0.0.4" ed25519-dalek = { version = "3.0.0-pre.6", features = ["rand_core"] }
prost = "0.14.3" chrono = { version = "0.4.44", features = ["serde"] }
prost-types = { version = "0.14.3", features = ["chrono"] } rand = "0.10.0"
rand = "0.10.1" rustls = { version = "0.23.37", features = ["aws-lc-rs"] }
rcgen = { version = "0.14.7", features = [ "aws_lc_rs", "pem", "x509-parser", "zeroize" ], default-features = false } smlang = "0.8.0"
rstest = "0.26.1" thiserror = "2.0.18"
rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false } async-trait = "0.1.89"
rustls-pki-types = "1.14.1" futures = "0.3.32"
sha2 = "0.11" tokio-stream = { version = "0.1.18", features = ["full"] }
smlang = "0.8.0" kameo = "0.19.2"
thiserror = "2.0.18" prost-types = { version = "0.14.3", features = ["chrono"] }
tokio = { version = "1.52.1", features = ["full"] } x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
tokio-stream = { version = "0.1.18", features = ["full"] } rstest = "0.26.1"
tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] } rustls-pki-types = "1.14.0"
tracing = "0.1.44" alloy = "1.7.3"
x25519-dalek = { version = "2.0.1", features = ["getrandom"] } rcgen = { version = "0.14.7", features = [
"aws_lc_rs",
[workspace.lints.rust] "pem",
missing_unsafe_on_extern = "deny" "x509-parser",
unsafe_attr_outside_unsafe = "deny" "zeroize",
unsafe_op_in_unsafe_fn = "deny" ], default-features = false }
unstable_features = "deny" k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
rsa = { version = "0.9", features = ["sha2"] }
deprecated_safe_2024 = "warn" sha2 = "0.10"
ffi_unwind_calls = "warn" spki = "0.7"
linker_messages = "warn" prost = "0.14.3"
miette = { version = "7.6.0", features = ["fancy", "serde"] }
elided_lifetimes_in_paths = "warn"
explicit_outlives_requirements = "warn"
impl-trait-overcaptures = "warn"
impl-trait-redundant-captures = "warn"
redundant_lifetimes = "warn"
single_use_lifetimes = "warn"
unused_lifetimes = "warn"
macro_use_extern_crate = "warn"
redundant_imports = "warn"
unused_import_braces = "warn"
unused_macro_rules = "warn"
unused_qualifications = "warn"
unit_bindings = "warn"
# missing_docs = "warn" # ENABLE BY THE FIRST MAJOR VERSION!!
unnameable_types = "warn"
[workspace.lints.clippy]
derive_partial_eq_without_eq = "allow"
future_not_send = "allow"
inconsistent_struct_constructor = "allow"
inline_always = "allow"
missing_errors_doc = "allow"
missing_fields_in_debug = "allow"
missing_panics_doc = "allow"
must_use_candidate = "allow"
needless_pass_by_ref_mut = "allow"
pub_underscore_fields = "allow"
redundant_pub_crate = "allow"
uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability
# restriction lints
alloc_instead_of_core = "warn"
allow_attributes_without_reason = "warn"
as_conversions = "warn"
assertions_on_result_states = "warn"
cfg_not_test = "warn"
clone_on_ref_ptr = "warn"
cognitive_complexity = "warn"
create_dir = "warn"
dbg_macro = "warn"
decimal_literal_representation = "warn"
default_union_representation = "warn"
deref_by_slicing = "warn"
disallowed_script_idents = "warn"
doc_include_without_cfg = "warn"
empty_drop = "warn"
empty_enum_variants_with_brackets = "warn"
empty_structs_with_brackets = "warn"
exit = "warn"
filetype_is_file = "warn"
float_arithmetic = "warn"
float_cmp_const = "warn"
fn_to_numeric_cast_any = "warn"
get_unwrap = "warn"
if_then_some_else_none = "warn"
indexing_slicing = "warn"
infinite_loop = "warn"
inline_asm_x86_att_syntax = "warn"
inline_asm_x86_intel_syntax = "warn"
integer_division = "warn"
large_include_file = "warn"
lossy_float_literal = "warn"
map_with_unused_argument_over_ranges = "warn"
mem_forget = "warn"
missing_assert_message = "warn"
mixed_read_write_in_expression = "warn"
modulo_arithmetic = "warn"
multiple_unsafe_ops_per_block = "warn"
mutex_atomic = "warn"
mutex_integer = "warn"
needless_raw_strings = "warn"
non_ascii_literal = "warn"
non_zero_suggestions = "warn"
pathbuf_init_then_push = "warn"
pointer_format = "warn"
precedence_bits = "warn"
pub_without_shorthand = "warn"
rc_buffer = "warn"
rc_mutex = "warn"
redundant_test_prefix = "warn"
redundant_type_annotations = "warn"
ref_patterns = "warn"
renamed_function_params = "warn"
rest_pat_in_fully_bound_structs = "warn"
return_and_then = "warn"
semicolon_inside_block = "warn"
str_to_string = "warn"
string_add = "warn"
string_lit_chars_any = "warn"
string_slice = "warn"
suspicious_xor_used_as_pow = "warn"
try_err = "warn"
undocumented_unsafe_blocks = "warn"
uninlined_format_args = "warn"
unnecessary_safety_comment = "warn"
unnecessary_safety_doc = "warn"
unnecessary_self_imports = "warn"
unneeded_field_pattern = "warn"
unused_result_ok = "warn"
verbose_file_reads = "warn"
# cargo lints
negative_feature_names = "warn"
redundant_feature_names = "warn"
wildcard_dependencies = "warn"
# ENABLE BY THE FIRST MAJOR VERSION!!
# todo = "warn"
# unimplemented = "warn"
# panic = "warn"
# panic_in_result_fn = "warn"
#
# cargo_common_metadata = "warn"
# multiple_crate_versions = "warn" # a controversial option since it's really difficult to maintain
disallowed_methods = "deny"
nursery = { level = "warn", priority = -1 }
pedantic = { level = "warn", priority = -1 }
type_repetition_in_bounds = "allow" # sometimes, it's better for readability this way

37
server/clippy.toml
View File

@@ -1,28 +1,9 @@
disallowed-methods = [ disallowed-methods = [
# RSA decryption is forbidden: the rsa crate has RUSTSEC-2023-0071 (Marvin Attack). # RSA decryption is forbidden: the rsa crate has RUSTSEC-2023-0071 (Marvin Attack).
# We only use RSA for Windows Hello (KeyCredentialManager) public-key verification — decryption # We only use RSA for Windows Hello (KeyCredentialManager) public-key verification — decryption
# is never required and must not be introduced. # is never required and must not be introduced.
{ path = "rsa::RsaPrivateKey::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." }, { path = "rsa::RsaPrivateKey::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." },
{ path = "rsa::RsaPrivateKey::decrypt_blinded", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." }, { path = "rsa::RsaPrivateKey::decrypt_blinded", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." },
{ path = "rsa::traits::Decryptor::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt() on rsa::{pkcs1v15,oaep}::DecryptingKey." }, { path = "rsa::traits::Decryptor::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt() on rsa::{pkcs1v15,oaep}::DecryptingKey." },
{ path = "rsa::traits::RandomizedDecryptor::decrypt_with_rng", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt_with_rng() on rsa::{pkcs1v15,oaep}::DecryptingKey." }, { path = "rsa::traits::RandomizedDecryptor::decrypt_with_rng", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt_with_rng() on rsa::{pkcs1v15,oaep}::DecryptingKey." },
] ]
allow-indexing-slicing-in-tests = true
allow-panic-in-tests = true
check-inconsistent-struct-field-initializers = true
suppress-restriction-lint-in-const = true
allow-renamed-params-for = [
"core::convert::From",
"core::convert::TryFrom",
"core::str::FromStr",
"kameo::actor::Actor",
]
module-items-ordered-within-groupings = ["UPPER_SNAKE_CASE"]
source-item-ordering = ["enum"]
trait-assoc-item-kinds-order = [
"const",
"type",
"fn",
] # community tested standard

55
server/crates/arbiter-client/Cargo.toml
View File

@@ -1,29 +1,26 @@
[package] [package]
name = "arbiter-client" name = "arbiter-client"
version = "0.1.0" version = "0.1.0"
edition = "2024" edition = "2024"
repository = "https://git.markettakers.org/MarketTakers/arbiter" repository = "https://git.markettakers.org/MarketTakers/arbiter"
license = "Apache-2.0" license = "Apache-2.0"
[lints] [lints]
workspace = true workspace = true
[features] [features]
evm = ["dep:alloy"] evm = ["dep:alloy"]
[dependencies] [dependencies]
arbiter-proto.path = "../arbiter-proto" arbiter-proto.path = "../arbiter-proto"
arbiter-crypto.path = "../arbiter-crypto" alloy = { workspace = true, optional = true }
alloy = { workspace = true, optional = true } tonic.workspace = true
tonic.workspace = true tonic.features = ["tls-aws-lc"]
tonic.features = ["tls-aws-lc"] tokio.workspace = true
tokio.workspace = true tokio-stream.workspace = true
tokio-stream.workspace = true ed25519-dalek.workspace = true
thiserror.workspace = true thiserror.workspace = true
http = "1.4.0" http = "1.4.0"
rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] } rustls-webpki = { version = "0.103.10", features = ["aws-lc-rs"] }
async-trait.workspace = true async-trait.workspace = true
chrono.workspace = true rand.workspace = true
[lib]
doctest = false

309
server/crates/arbiter-client/src/auth.rs
View File

@@ -1,160 +1,149 @@
use crate::{ use arbiter_proto::{
storage::StorageError, ClientMetadata, format_challenge,
transport::{ClientTransport, next_request_id}, proto::{
}; client::{
use arbiter_crypto::authn::{self, CLIENT_CONTEXT, SigningKey}; ClientRequest,
use arbiter_proto::{ auth::{
ClientMetadata, self as proto_auth, AuthChallenge, AuthChallengeRequest, AuthChallengeSolution,
proto::{ AuthResult, request::Payload as AuthRequestPayload,
client::{ response::Payload as AuthResponsePayload,
ClientRequest, },
auth::{ client_request::Payload as ClientRequestPayload,
self as proto_auth, AuthChallenge, AuthChallengeRequest, AuthChallengeSolution, client_response::Payload as ClientResponsePayload,
AuthResult, request::Payload as AuthRequestPayload, },
response::Payload as AuthResponsePayload, shared::ClientInfo as ProtoClientInfo,
}, },
client_request::Payload as ClientRequestPayload, };
client_response::Payload as ClientResponsePayload, use ed25519_dalek::Signer as _;
},
shared::ClientInfo as ProtoClientInfo, use crate::{
}, storage::StorageError,
}; transport::{ClientTransport, next_request_id},
};
use chrono::DateTime;
#[derive(Debug, thiserror::Error)]
#[derive(Debug, thiserror::Error)] pub enum AuthError {
pub enum AuthError { #[error("Auth challenge was not returned by server")]
#[error("Server sent invalid auth challenge")] MissingAuthChallenge,
InvalidChallenge,
#[error("Client approval denied by Operator")] #[error("Client approval denied by User Agent")]
ApprovalDenied, ApprovalDenied,
#[error("Auth challenge was not returned by server")]
MissingAuthChallenge, #[error("No User Agents online to approve client")]
NoUserAgentsOnline,
#[error("No Operators online to approve client")]
NoOperatorsOnline, #[error("Unexpected auth response payload")]
UnexpectedAuthResponse,
#[error("Signing key storage error")]
Storage(#[from] StorageError), #[error("Signing key storage error")]
Storage(#[from] StorageError),
#[error("Unexpected auth response payload")] }
UnexpectedAuthResponse,
} fn map_auth_result(code: i32) -> AuthError {
match AuthResult::try_from(code).unwrap_or(AuthResult::Unspecified) {
fn map_auth_result(code: i32) -> AuthError { AuthResult::ApprovalDenied => AuthError::ApprovalDenied,
match AuthResult::try_from(code).unwrap_or(AuthResult::Unspecified) { AuthResult::NoUserAgentsOnline => AuthError::NoUserAgentsOnline,
AuthResult::ApprovalDenied => AuthError::ApprovalDenied, AuthResult::Unspecified
AuthResult::NoOperatorsOnline => AuthError::NoOperatorsOnline, | AuthResult::Success
AuthResult::Unspecified | AuthResult::InvalidKey
| AuthResult::Success | AuthResult::InvalidSignature
| AuthResult::InvalidKey | AuthResult::Internal => AuthError::UnexpectedAuthResponse,
| AuthResult::InvalidSignature }
| AuthResult::Internal => AuthError::UnexpectedAuthResponse, }
}
} async fn send_auth_challenge_request(
transport: &mut ClientTransport,
async fn send_auth_challenge_request( metadata: ClientMetadata,
transport: &mut ClientTransport, key: &ed25519_dalek::SigningKey,
metadata: ClientMetadata, ) -> std::result::Result<(), AuthError> {
key: &SigningKey, transport
) -> Result<(), AuthError> { .send(ClientRequest {
transport request_id: next_request_id(),
.send(ClientRequest { payload: Some(ClientRequestPayload::Auth(proto_auth::Request {
request_id: next_request_id(), payload: Some(AuthRequestPayload::ChallengeRequest(AuthChallengeRequest {
payload: Some(ClientRequestPayload::Auth(proto_auth::Request { pubkey: key.verifying_key().to_bytes().to_vec(),
payload: Some(AuthRequestPayload::ChallengeRequest(AuthChallengeRequest { client_info: Some(ProtoClientInfo {
pubkey: key.public_key().to_bytes(), name: metadata.name,
client_info: Some(ProtoClientInfo { description: metadata.description,
name: metadata.name, version: metadata.version,
description: metadata.description, }),
version: metadata.version, })),
}), })),
})), })
})), .await
}) .map_err(|_| AuthError::UnexpectedAuthResponse)
.await }
.map_err(|_| AuthError::UnexpectedAuthResponse)
} async fn receive_auth_challenge(
transport: &mut ClientTransport,
async fn receive_auth_challenge( ) -> std::result::Result<AuthChallenge, AuthError> {
transport: &mut ClientTransport, let response = transport
) -> Result<AuthChallenge, AuthError> { .recv()
let response = transport .await
.recv() .map_err(|_| AuthError::MissingAuthChallenge)?;
.await
.map_err(|_| AuthError::MissingAuthChallenge)?; let payload = response.payload.ok_or(AuthError::MissingAuthChallenge)?;
match payload {
let payload = response.payload.ok_or(AuthError::MissingAuthChallenge)?; ClientResponsePayload::Auth(response) => match response.payload {
match payload { Some(AuthResponsePayload::Challenge(challenge)) => Ok(challenge),
ClientResponsePayload::Auth(response) => match response.payload { Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)),
Some(AuthResponsePayload::Challenge(challenge)) => Ok(challenge), None => Err(AuthError::MissingAuthChallenge),
Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)), },
None => Err(AuthError::MissingAuthChallenge), _ => Err(AuthError::UnexpectedAuthResponse),
}, }
_ => Err(AuthError::UnexpectedAuthResponse), }
}
} async fn send_auth_challenge_solution(
transport: &mut ClientTransport,
async fn send_auth_challenge_solution( key: &ed25519_dalek::SigningKey,
transport: &mut ClientTransport, challenge: AuthChallenge,
key: &SigningKey, ) -> std::result::Result<(), AuthError> {
challenge: AuthChallenge, let challenge_payload = format_challenge(challenge.nonce, &challenge.pubkey);
) -> Result<(), AuthError> { let signature = key.sign(&challenge_payload).to_bytes().to_vec();
let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed());
let challenge = authn::AuthChallenge { transport
nonce: *challenge .send(ClientRequest {
.random request_id: next_request_id(),
.as_array() payload: Some(ClientRequestPayload::Auth(proto_auth::Request {
.ok_or(AuthError::InvalidChallenge)?, payload: Some(AuthRequestPayload::ChallengeSolution(
timestamp, AuthChallengeSolution { signature },
}; )),
let challenge_payload: Vec<u8> = challenge.format(); })),
let signature = key })
.sign_message(&challenge_payload, CLIENT_CONTEXT) .await
.map_err(|_| AuthError::UnexpectedAuthResponse)? .map_err(|_| AuthError::UnexpectedAuthResponse)
.to_bytes(); }
transport async fn receive_auth_confirmation(
.send(ClientRequest { transport: &mut ClientTransport,
request_id: next_request_id(), ) -> std::result::Result<(), AuthError> {
payload: Some(ClientRequestPayload::Auth(proto_auth::Request { let response = transport
payload: Some(AuthRequestPayload::ChallengeSolution( .recv()
AuthChallengeSolution { signature }, .await
)), .map_err(|_| AuthError::UnexpectedAuthResponse)?;
})),
}) let payload = response.payload.ok_or(AuthError::UnexpectedAuthResponse)?;
.await match payload {
.map_err(|_| AuthError::UnexpectedAuthResponse) ClientResponsePayload::Auth(response) => match response.payload {
} Some(AuthResponsePayload::Result(result))
if AuthResult::try_from(result).ok() == Some(AuthResult::Success) =>
async fn receive_auth_confirmation(transport: &mut ClientTransport) -> Result<(), AuthError> { {
let response = transport Ok(())
.recv() }
.await Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)),
.map_err(|_| AuthError::UnexpectedAuthResponse)?; _ => Err(AuthError::UnexpectedAuthResponse),
},
let payload = response.payload.ok_or(AuthError::UnexpectedAuthResponse)?; _ => Err(AuthError::UnexpectedAuthResponse),
match payload { }
ClientResponsePayload::Auth(response) => match response.payload { }
Some(AuthResponsePayload::Result(result))
if AuthResult::try_from(result).ok() == Some(AuthResult::Success) => pub(crate) async fn authenticate(
{ transport: &mut ClientTransport,
Ok(()) metadata: ClientMetadata,
} key: &ed25519_dalek::SigningKey,
Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)), ) -> std::result::Result<(), AuthError> {
_ => Err(AuthError::UnexpectedAuthResponse), send_auth_challenge_request(transport, metadata, key).await?;
}, let challenge = receive_auth_challenge(transport).await?;
_ => Err(AuthError::UnexpectedAuthResponse), send_auth_challenge_solution(transport, key, challenge).await?;
} receive_auth_confirmation(transport).await
} }
pub async fn authenticate(
transport: &mut ClientTransport,
metadata: ClientMetadata,
key: &SigningKey,
) -> Result<(), AuthError> {
send_auth_challenge_request(transport, metadata, key).await?;
let challenge = receive_auth_challenge(transport).await?;
send_auth_challenge_solution(transport, key, challenge).await?;
receive_auth_confirmation(transport).await
}

88
server/crates/arbiter-client/src/bin/test_connect.rs
View File

@@ -1,44 +1,44 @@
use arbiter_client::ArbiterClient; use std::io::{self, Write};
use arbiter_proto::{ClientMetadata, url::ArbiterUrl};
use arbiter_client::ArbiterClient;
use std::io::{self, Write}; use arbiter_proto::{ClientMetadata, url::ArbiterUrl};
#[tokio::main] #[tokio::main]
async fn main() { async fn main() {
println!("Testing connection to Arbiter server..."); println!("Testing connection to Arbiter server...");
print!("Enter ArbiterUrl: "); print!("Enter ArbiterUrl: ");
let _ = io::stdout().flush(); let _ = io::stdout().flush();
let mut input = String::new(); let mut input = String::new();
if let Err(err) = io::stdin().read_line(&mut input) { if let Err(err) = io::stdin().read_line(&mut input) {
eprintln!("Failed to read input: {err}"); eprintln!("Failed to read input: {err}");
return; return;
} }
let input = input.trim(); let input = input.trim();
if input.is_empty() { if input.is_empty() {
eprintln!("ArbiterUrl cannot be empty"); eprintln!("ArbiterUrl cannot be empty");
return; return;
} }
let url = match ArbiterUrl::try_from(input) { let url = match ArbiterUrl::try_from(input) {
Ok(url) => url, Ok(url) => url,
Err(err) => { Err(err) => {
eprintln!("Invalid ArbiterUrl: {err}"); eprintln!("Invalid ArbiterUrl: {err}");
return; return;
} }
}; };
println!("{url:#?}"); println!("{:#?}", url);
let metadata = ClientMetadata { let metadata = ClientMetadata {
name: "arbiter-client test_connect".to_owned(), name: "arbiter-client test_connect".to_string(),
description: Some("Manual connection smoke test".to_owned()), description: Some("Manual connection smoke test".to_string()),
version: Some(env!("CARGO_PKG_VERSION").to_owned()), version: Some(env!("CARGO_PKG_VERSION").to_string()),
}; };
match ArbiterClient::connect(url, metadata).await { match ArbiterClient::connect(url, metadata).await {
Ok(_) => println!("Connected and authenticated successfully."), Ok(_) => println!("Connected and authenticated successfully."),
Err(err) => eprintln!("Failed to connect: {err:#?}"), Err(err) => eprintln!("Failed to connect: {:#?}", err),
} }
} }

195
server/crates/arbiter-client/src/client.rs
View File

@@ -1,101 +1,94 @@
#[cfg(feature = "evm")] use arbiter_proto::{
use crate::wallets::evm::ArbiterEvmWallet; ClientMetadata, proto::arbiter_service_client::ArbiterServiceClient, url::ArbiterUrl,
use crate::{ };
StorageError, use std::sync::Arc;
auth::{AuthError, authenticate}, use tokio::sync::{Mutex, mpsc};
storage::{FileSigningKeyStorage, SigningKeyStorage}, use tokio_stream::wrappers::ReceiverStream;
transport::{BUFFER_LENGTH, ClientTransport}, use tonic::transport::ClientTlsConfig;
};
use arbiter_crypto::authn::SigningKey; use crate::{
use arbiter_proto::{ StorageError,
ClientMetadata, proto::arbiter_service_client::ArbiterServiceClient, url::ArbiterUrl, auth::{AuthError, authenticate},
}; storage::{FileSigningKeyStorage, SigningKeyStorage},
transport::{BUFFER_LENGTH, ClientTransport},
use std::sync::Arc; };
use tokio::sync::{Mutex, mpsc};
use tokio_stream::wrappers::ReceiverStream; #[cfg(feature = "evm")]
use tonic::transport::ClientTlsConfig; use crate::wallets::evm::ArbiterEvmWallet;
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
pub enum ArbiterClientError { pub enum Error {
#[error("Authentication error")] #[error("gRPC error")]
Authentication(#[from] AuthError), Grpc(#[from] tonic::Status),
#[error("Could not establish connection")] #[error("Could not establish connection")]
Connection(#[from] tonic::transport::Error), Connection(#[from] tonic::transport::Error),
#[error("gRPC error")] #[error("Invalid server URI")]
Grpc(#[from] tonic::Status), InvalidUri(#[from] http::uri::InvalidUri),
#[error("Invalid CA certificate")] #[error("Invalid CA certificate")]
InvalidCaCert(#[from] webpki::Error), InvalidCaCert(#[from] webpki::Error),
#[error("Invalid server URI")] #[error("Authentication error")]
InvalidUri(#[from] http::uri::InvalidUri), Authentication(#[from] AuthError),
#[error("Storage error")] #[error("Storage error")]
Storage(#[from] StorageError), Storage(#[from] StorageError),
} }
pub struct ArbiterClient { pub struct ArbiterClient {
#[expect( #[allow(dead_code)]
dead_code, transport: Arc<Mutex<ClientTransport>>,
reason = "transport will be used in future methods for sending requests and receiving responses" }
)]
transport: Arc<Mutex<ClientTransport>>, impl ArbiterClient {
} pub async fn connect(url: ArbiterUrl, metadata: ClientMetadata) -> Result<Self, Error> {
let storage = FileSigningKeyStorage::from_default_location()?;
impl ArbiterClient { Self::connect_with_storage(url, metadata, &storage).await
pub async fn connect( }
url: ArbiterUrl,
metadata: ClientMetadata, pub async fn connect_with_storage<S: SigningKeyStorage>(
) -> Result<Self, ArbiterClientError> { url: ArbiterUrl,
let storage = FileSigningKeyStorage::from_default_location()?; metadata: ClientMetadata,
Self::connect_with_storage(url, metadata, &storage).await storage: &S,
} ) -> Result<Self, Error> {
let key = storage.load_or_create()?;
pub async fn connect_with_storage<S: SigningKeyStorage>( Self::connect_with_key(url, metadata, key).await
url: ArbiterUrl, }
metadata: ClientMetadata,
storage: &S, pub async fn connect_with_key(
) -> Result<Self, ArbiterClientError> { url: ArbiterUrl,
let key = storage.load_or_create()?; metadata: ClientMetadata,
Self::connect_with_key(url, metadata, key).await key: ed25519_dalek::SigningKey,
} ) -> Result<Self, Error> {
let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
pub async fn connect_with_key( let tls = ClientTlsConfig::new().trust_anchor(anchor);
url: ArbiterUrl,
metadata: ClientMetadata, let channel =
key: SigningKey, tonic::transport::Channel::from_shared(format!("https://{}:{}", url.host, url.port))?
) -> Result<Self, ArbiterClientError> { .tls_config(tls)?
let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned(); .connect()
let tls = ClientTlsConfig::new().trust_anchor(anchor); .await?;
let channel = let mut client = ArbiterServiceClient::new(channel);
tonic::transport::Channel::from_shared(format!("https://{}:{}", url.host, url.port))? let (tx, rx) = mpsc::channel(BUFFER_LENGTH);
.tls_config(tls)? let response_stream = client.client(ReceiverStream::new(rx)).await?.into_inner();
.connect()
.await?; let mut transport = ClientTransport {
sender: tx,
let mut client = ArbiterServiceClient::new(channel); receiver: response_stream,
let (tx, rx) = mpsc::channel(BUFFER_LENGTH); };
let response_stream = client.client(ReceiverStream::new(rx)).await?.into_inner();
authenticate(&mut transport, metadata, &key).await?;
let mut transport = ClientTransport {
sender: tx, Ok(Self {
receiver: response_stream, transport: Arc::new(Mutex::new(transport)),
}; })
}
authenticate(&mut transport, metadata, &key).await?;
#[cfg(feature = "evm")]
Ok(Self { pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, Error> {
transport: Arc::new(Mutex::new(transport)), todo!("fetch EVM wallet list from server")
}) }
} }
#[cfg(feature = "evm")]
#[expect(clippy::unused_async, reason = "false positive")]
pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, ArbiterClientError> {
todo!("fetch EVM wallet list from server")
}
}

24
server/crates/arbiter-client/src/lib.rs
View File

@@ -1,12 +1,12 @@
mod auth; mod auth;
mod client; mod client;
mod storage; mod storage;
mod transport; mod transport;
pub mod wallets; pub mod wallets;
pub use auth::AuthError; pub use auth::AuthError;
pub use client::{ArbiterClient, ArbiterClientError}; pub use client::{ArbiterClient, Error};
pub use storage::{FileSigningKeyStorage, SigningKeyStorage, StorageError}; pub use storage::{FileSigningKeyStorage, SigningKeyStorage, StorageError};
#[cfg(feature = "evm")] #[cfg(feature = "evm")]
pub use wallets::evm::{ArbiterEvmSignTransactionError, ArbiterEvmWallet}; pub use wallets::evm::{ArbiterEvmSignTransactionError, ArbiterEvmWallet};

266
server/crates/arbiter-client/src/storage.rs
View File

@@ -1,134 +1,132 @@
use arbiter_crypto::authn::SigningKey; use arbiter_proto::home_path;
use arbiter_proto::home_path; use std::path::{Path, PathBuf};
use std::path::{Path, PathBuf}; #[derive(Debug, thiserror::Error)]
pub enum StorageError {
#[derive(Debug, thiserror::Error)] #[error("I/O error")]
pub enum StorageError { Io(#[from] std::io::Error),
#[error("Invalid signing key length in storage: expected {expected} bytes, got {actual} bytes")]
InvalidKeyLength { expected: usize, actual: usize }, #[error("Invalid signing key length in storage: expected {expected} bytes, got {actual} bytes")]
InvalidKeyLength { expected: usize, actual: usize },
#[error("I/O error")] }
Io(#[from] std::io::Error),
} pub trait SigningKeyStorage {
fn load_or_create(&self) -> std::result::Result<ed25519_dalek::SigningKey, StorageError>;
pub trait SigningKeyStorage { }
fn load_or_create(&self) -> Result<SigningKey, StorageError>;
} #[derive(Debug, Clone)]
pub struct FileSigningKeyStorage {
#[derive(Debug, Clone)] path: PathBuf,
pub struct FileSigningKeyStorage { }
path: PathBuf,
} impl FileSigningKeyStorage {
pub const DEFAULT_FILE_NAME: &str = "sdk_client_ed25519.key";
impl FileSigningKeyStorage {
pub const DEFAULT_FILE_NAME: &str = "sdk_client_ml_dsa.key"; pub fn new(path: impl Into<PathBuf>) -> Self {
Self { path: path.into() }
pub fn new(path: impl Into<PathBuf>) -> Self { }
Self { path: path.into() }
} pub fn from_default_location() -> std::result::Result<Self, StorageError> {
Ok(Self::new(home_path()?.join(Self::DEFAULT_FILE_NAME)))
pub fn from_default_location() -> Result<Self, StorageError> { }
Ok(Self::new(home_path()?.join(Self::DEFAULT_FILE_NAME)))
} fn read_key(path: &Path) -> std::result::Result<ed25519_dalek::SigningKey, StorageError> {
let bytes = std::fs::read(path)?;
fn read_key(path: &Path) -> Result<SigningKey, StorageError> { let raw: [u8; 32] =
let bytes = std::fs::read(path)?; bytes
let raw: [u8; 32] = .try_into()
bytes .map_err(|v: Vec<u8>| StorageError::InvalidKeyLength {
.try_into() expected: 32,
.map_err(|v: Vec<u8>| StorageError::InvalidKeyLength { actual: v.len(),
expected: 32, })?;
actual: v.len(), Ok(ed25519_dalek::SigningKey::from_bytes(&raw))
})?; }
Ok(SigningKey::from_seed(raw)) }
}
} impl SigningKeyStorage for FileSigningKeyStorage {
fn load_or_create(&self) -> std::result::Result<ed25519_dalek::SigningKey, StorageError> {
impl SigningKeyStorage for FileSigningKeyStorage { if let Some(parent) = self.path.parent() {
fn load_or_create(&self) -> Result<SigningKey, StorageError> { std::fs::create_dir_all(parent)?;
if let Some(parent) = self.path.parent() { }
std::fs::create_dir_all(parent)?;
} if self.path.exists() {
return Self::read_key(&self.path);
if self.path.exists() { }
return Self::read_key(&self.path);
} let key = ed25519_dalek::SigningKey::generate(&mut rand::rng());
let raw_key = key.to_bytes();
let key = SigningKey::generate();
let raw_key = key.to_seed(); // Use create_new to prevent accidental overwrite if another process creates the key first.
match std::fs::OpenOptions::new()
// Use create_new to prevent accidental overwrite if another process creates the key first. .create_new(true)
match std::fs::OpenOptions::new() .write(true)
.create_new(true) .open(&self.path)
.write(true) {
.open(&self.path) Ok(mut file) => {
{ use std::io::Write as _;
Ok(mut file) => { file.write_all(&raw_key)?;
use std::io::Write as _; Ok(key)
file.write_all(&raw_key)?; }
Ok(key) Err(err) if err.kind() == std::io::ErrorKind::AlreadyExists => {
} Self::read_key(&self.path)
Err(err) if err.kind() == std::io::ErrorKind::AlreadyExists => { }
Self::read_key(&self.path) Err(err) => Err(StorageError::Io(err)),
} }
Err(err) => Err(StorageError::Io(err)), }
} }
}
} #[cfg(test)]
mod tests {
#[cfg(test)] use super::{FileSigningKeyStorage, SigningKeyStorage, StorageError};
mod tests {
use super::{FileSigningKeyStorage, SigningKeyStorage, StorageError}; fn unique_temp_key_path() -> std::path::PathBuf {
let nanos = std::time::SystemTime::now()
fn unique_temp_key_path() -> std::path::PathBuf { .duration_since(std::time::UNIX_EPOCH)
let nanos = std::time::SystemTime::now() .expect("clock should be after unix epoch")
.duration_since(std::time::UNIX_EPOCH) .as_nanos();
.expect("clock should be after unix epoch") std::env::temp_dir().join(format!(
.as_nanos(); "arbiter-client-key-{}-{}.bin",
std::env::temp_dir().join(format!( std::process::id(),
"arbiter-client-key-{}-{}.bin", nanos
std::process::id(), ))
nanos }
))
} #[test]
fn file_storage_creates_and_reuses_key() {
#[test] let path = unique_temp_key_path();
fn file_storage_creates_and_reuses_key() { let storage = FileSigningKeyStorage::new(path.clone());
let path = unique_temp_key_path();
let storage = FileSigningKeyStorage::new(path.clone()); let key_a = storage
.load_or_create()
let key_a = storage .expect("first load_or_create should create key");
.load_or_create() let key_b = storage
.expect("first load_or_create should create key"); .load_or_create()
let key_b = storage .expect("second load_or_create should read same key");
.load_or_create()
.expect("second load_or_create should read same key"); assert_eq!(key_a.to_bytes(), key_b.to_bytes());
assert!(path.exists());
assert_eq!(key_a.to_seed(), key_b.to_seed());
assert!(path.exists()); std::fs::remove_file(path).expect("temp key file should be removable");
}
std::fs::remove_file(path).expect("temp key file should be removable");
} #[test]
fn file_storage_rejects_invalid_key_length() {
#[test] let path = unique_temp_key_path();
fn file_storage_rejects_invalid_key_length() { std::fs::write(&path, [42u8; 31]).expect("should write invalid key file");
let path = unique_temp_key_path(); let storage = FileSigningKeyStorage::new(path.clone());
std::fs::write(&path, [42u8; 31]).expect("should write invalid key file");
let storage = FileSigningKeyStorage::new(path.clone()); let err = storage
.load_or_create()
let err = storage .expect_err("storage should reject non-32-byte key file");
.load_or_create()
.expect_err("storage should reject non-32-byte key file"); match err {
StorageError::InvalidKeyLength { expected, actual } => {
match err { assert_eq!(expected, 32);
StorageError::InvalidKeyLength { expected, actual } => { assert_eq!(actual, 31);
assert_eq!(expected, 32); }
assert_eq!(actual, 31); other => panic!("unexpected error: {other:?}"),
} }
other @ StorageError::Io(_) => panic!("unexpected error: {other:?}"),
} std::fs::remove_file(path).expect("temp key file should be removable");
}
std::fs::remove_file(path).expect("temp key file should be removable"); }
}
}

85
server/crates/arbiter-client/src/transport.rs
View File

@@ -1,41 +1,44 @@
use arbiter_proto::proto::client::{ClientRequest, ClientResponse}; use arbiter_proto::proto::client::{ClientRequest, ClientResponse};
use std::sync::atomic::{AtomicI32, Ordering};
use std::sync::atomic::{AtomicI32, Ordering}; use tokio::sync::mpsc;
use tokio::sync::mpsc;
pub(crate) const BUFFER_LENGTH: usize = 16;
pub const BUFFER_LENGTH: usize = 16; static NEXT_REQUEST_ID: AtomicI32 = AtomicI32::new(1);
static NEXT_REQUEST_ID: AtomicI32 = AtomicI32::new(1);
pub(crate) fn next_request_id() -> i32 {
pub fn next_request_id() -> i32 { NEXT_REQUEST_ID.fetch_add(1, Ordering::Relaxed)
NEXT_REQUEST_ID.fetch_add(1, Ordering::Relaxed) }
}
#[derive(Debug, thiserror::Error)]
#[derive(Debug, thiserror::Error)] pub(crate) enum ClientSignError {
pub enum ClientSignError { #[error("Transport channel closed")]
#[error("Transport channel closed")] ChannelClosed,
ChannelClosed,
#[error("Connection closed by server")]
#[error("Connection closed by server")] ConnectionClosed,
ConnectionClosed, }
}
pub(crate) struct ClientTransport {
pub struct ClientTransport { pub(crate) sender: mpsc::Sender<ClientRequest>,
pub(crate) sender: mpsc::Sender<ClientRequest>, pub(crate) receiver: tonic::Streaming<ClientResponse>,
pub(crate) receiver: tonic::Streaming<ClientResponse>, }
}
impl ClientTransport {
impl ClientTransport { pub(crate) async fn send(
pub(crate) async fn send(&mut self, request: ClientRequest) -> Result<(), ClientSignError> { &mut self,
self.sender request: ClientRequest,
.send(request) ) -> std::result::Result<(), ClientSignError> {
.await self.sender
.map_err(|_| ClientSignError::ChannelClosed) .send(request)
} .await
.map_err(|_| ClientSignError::ChannelClosed)
pub(crate) async fn recv(&mut self) -> Result<ClientResponse, ClientSignError> { }
match self.receiver.message().await {
Ok(Some(resp)) => Ok(resp), pub(crate) async fn recv(&mut self) -> std::result::Result<ClientResponse, ClientSignError> {
Ok(None) | Err(_) => Err(ClientSignError::ConnectionClosed), match self.receiver.message().await {
} Ok(Some(resp)) => Ok(resp),
} Ok(None) => Err(ClientSignError::ConnectionClosed),
} Err(_) => Err(ClientSignError::ConnectionClosed),
}
}
}

389
server/crates/arbiter-client/src/wallets/evm.rs
View File

@@ -1,197 +1,192 @@
use crate::transport::{ClientTransport, next_request_id}; use alloy::{
use arbiter_proto::proto::{ consensus::SignableTransaction,
client::{ network::TxSigner,
ClientRequest, primitives::{Address, B256, ChainId, Signature},
client_request::Payload as ClientRequestPayload, signers::{Error, Result, Signer},
client_response::Payload as ClientResponsePayload, };
evm::{ use async_trait::async_trait;
self as proto_evm, request::Payload as EvmRequestPayload, use std::sync::Arc;
response::Payload as EvmResponsePayload, use tokio::sync::Mutex;
},
}, use arbiter_proto::proto::{
evm::{ client::{
EvmSignTransactionRequest, ClientRequest,
evm_sign_transaction_response::Result as EvmSignTransactionResult, client_request::Payload as ClientRequestPayload,
}, client_response::Payload as ClientResponsePayload,
shared::evm::TransactionEvalError, evm::{
}; self as proto_evm, request::Payload as EvmRequestPayload,
response::Payload as EvmResponsePayload,
use alloy::{ },
consensus::SignableTransaction, },
network::TxSigner, evm::{
primitives::{Address, B256, ChainId, Signature}, EvmSignTransactionRequest,
signers::{Error, Result, Signer}, evm_sign_transaction_response::Result as EvmSignTransactionResult,
}; },
use async_trait::async_trait; shared::evm::TransactionEvalError,
use std::sync::Arc; };
use tokio::sync::Mutex;
use crate::transport::{ClientTransport, next_request_id};
/// A typed error payload returned by [`ArbiterEvmWallet`] transaction signing.
/// /// A typed error payload returned by [`ArbiterEvmWallet`] transaction signing.
/// This is wrapped into `alloy::signers::Error::Other`, so consumers can downcast by [`TryFrom`] and ///
/// interpret the concrete policy evaluation failure instead of parsing strings. /// This is wrapped into `alloy::signers::Error::Other`, so consumers can downcast by [`TryFrom`] and
#[derive(Debug, thiserror::Error)] /// interpret the concrete policy evaluation failure instead of parsing strings.
#[non_exhaustive] #[derive(Debug, thiserror::Error)]
pub enum ArbiterEvmSignTransactionError { #[non_exhaustive]
#[error("transaction rejected by policy: {0:?}")] pub enum ArbiterEvmSignTransactionError {
PolicyEval(TransactionEvalError), #[error("transaction rejected by policy: {0:?}")]
} PolicyEval(TransactionEvalError),
}
impl<'a> TryFrom<&'a Error> for &'a ArbiterEvmSignTransactionError {
type Error = (); impl<'a> TryFrom<&'a Error> for &'a ArbiterEvmSignTransactionError {
type Error = ();
fn try_from(value: &'a Error) -> Result<Self, Self::Error> {
if let Error::Other(inner) = value fn try_from(value: &'a Error) -> Result<Self, Self::Error> {
&& let Some(eval_error) = inner.downcast_ref() if let Error::Other(inner) = value
{ && let Some(eval_error) = inner.downcast_ref()
Ok(eval_error) {
} else { Ok(eval_error)
Err(()) } else {
} Err(())
} }
} }
}
pub struct ArbiterEvmWallet {
transport: Arc<Mutex<ClientTransport>>, pub struct ArbiterEvmWallet {
address: Address, transport: Arc<Mutex<ClientTransport>>,
chain_id: Option<ChainId>, address: Address,
} chain_id: Option<ChainId>,
}
impl ArbiterEvmWallet {
#[expect( impl ArbiterEvmWallet {
dead_code, pub(crate) fn new(transport: Arc<Mutex<ClientTransport>>, address: Address) -> Self {
reason = "new will be used in future methods for creating wallets with different parameters" Self {
)] transport,
pub(crate) const fn new(transport: Arc<Mutex<ClientTransport>>, address: Address) -> Self { address,
Self { chain_id: None,
transport, }
address, }
chain_id: None,
} pub fn address(&self) -> Address {
} self.address
}
pub const fn address(&self) -> Address {
self.address pub fn with_chain_id(mut self, chain_id: ChainId) -> Self {
} self.chain_id = Some(chain_id);
self
#[must_use] }
pub const fn with_chain_id(mut self, chain_id: ChainId) -> Self {
self.chain_id = Some(chain_id); fn validate_chain_id(&self, tx: &mut dyn SignableTransaction<Signature>) -> Result<()> {
self if let Some(chain_id) = self.chain_id
} && !tx.set_chain_id_checked(chain_id)
{
fn validate_chain_id(&self, tx: &mut dyn SignableTransaction<Signature>) -> Result<()> { return Err(Error::TransactionChainIdMismatch {
if let Some(chain_id) = self.chain_id signer: chain_id,
&& !tx.set_chain_id_checked(chain_id) tx: tx.chain_id().unwrap(),
{ });
return Err(Error::TransactionChainIdMismatch { }
signer: chain_id,
tx: tx.chain_id().unwrap(), Ok(())
}); }
} }
Ok(()) #[async_trait]
} impl Signer for ArbiterEvmWallet {
} async fn sign_hash(&self, _hash: &B256) -> Result<Signature> {
Err(Error::other(
#[async_trait] "hash-only signing is not supported for ArbiterEvmWallet; use transaction signing",
impl Signer for ArbiterEvmWallet { ))
async fn sign_hash(&self, _hash: &B256) -> Result<Signature> { }
Err(Error::other(
"hash-only signing is not supported for ArbiterEvmWallet; use transaction signing", fn address(&self) -> Address {
)) self.address
} }
fn address(&self) -> Address { fn chain_id(&self) -> Option<ChainId> {
self.address self.chain_id
} }
fn chain_id(&self) -> Option<ChainId> { fn set_chain_id(&mut self, chain_id: Option<ChainId>) {
self.chain_id self.chain_id = chain_id;
} }
}
fn set_chain_id(&mut self, chain_id: Option<ChainId>) {
self.chain_id = chain_id; #[async_trait]
} impl TxSigner<Signature> for ArbiterEvmWallet {
} fn address(&self) -> Address {
self.address
#[async_trait] }
impl TxSigner<Signature> for ArbiterEvmWallet {
fn address(&self) -> Address { async fn sign_transaction(
self.address &self,
} tx: &mut dyn SignableTransaction<Signature>,
) -> Result<Signature> {
async fn sign_transaction( self.validate_chain_id(tx)?;
&self,
tx: &mut dyn SignableTransaction<Signature>, let mut transport = self.transport.lock().await;
) -> Result<Signature> { let request_id = next_request_id();
self.validate_chain_id(tx)?; let rlp_transaction = tx.encoded_for_signing();
let mut transport = self.transport.lock().await; transport
let request_id = next_request_id(); .send(ClientRequest {
let rlp_transaction = tx.encoded_for_signing(); request_id,
payload: Some(ClientRequestPayload::Evm(proto_evm::Request {
transport payload: Some(EvmRequestPayload::SignTransaction(
.send(ClientRequest { EvmSignTransactionRequest {
request_id, wallet_address: self.address.to_vec(),
payload: Some(ClientRequestPayload::Evm(proto_evm::Request { rlp_transaction,
payload: Some(EvmRequestPayload::SignTransaction( },
EvmSignTransactionRequest { )),
wallet_address: self.address.to_vec(), })),
rlp_transaction, })
}, .await
)), .map_err(|_| Error::other("failed to send evm sign transaction request"))?;
})),
}) let response = transport
.await .recv()
.map_err(|_| Error::other("failed to send evm sign transaction request"))?; .await
.map_err(|_| Error::other("failed to receive evm sign transaction response"))?;
let response = transport
.recv() if response.request_id != Some(request_id) {
.await return Err(Error::other(
.map_err(|_| Error::other("failed to receive evm sign transaction response"))?; "received mismatched response id for evm sign transaction",
drop(transport); ));
}
if response.request_id != Some(request_id) {
return Err(Error::other( let payload = response
"received mismatched response id for evm sign transaction", .payload
)); .ok_or_else(|| Error::other("missing evm sign transaction response payload"))?;
}
let ClientResponsePayload::Evm(proto_evm::Response {
let payload = response payload: Some(payload),
.payload }) = payload
.ok_or_else(|| Error::other("missing evm sign transaction response payload"))?; else {
return Err(Error::other(
let ClientResponsePayload::Evm(proto_evm::Response { "unexpected response payload for evm sign transaction request",
payload: Some(payload), ));
}) = payload };
else {
return Err(Error::other( let EvmResponsePayload::SignTransaction(response) = payload else {
"unexpected response payload for evm sign transaction request", return Err(Error::other(
)); "unexpected evm response payload for sign transaction request",
}; ));
};
let EvmResponsePayload::SignTransaction(response) = payload else {
return Err(Error::other( let result = response
"unexpected evm response payload for sign transaction request", .result
)); .ok_or_else(|| Error::other("missing evm sign transaction result"))?;
};
match result {
let result = response EvmSignTransactionResult::Signature(signature) => {
.result Signature::try_from(signature.as_slice())
.ok_or_else(|| Error::other("missing evm sign transaction result"))?; .map_err(|_| Error::other("invalid signature returned by server"))
}
match result { EvmSignTransactionResult::EvalError(eval_error) => Err(Error::other(
EvmSignTransactionResult::Signature(signature) => { ArbiterEvmSignTransactionError::PolicyEval(eval_error),
Signature::try_from(signature.as_slice()) )),
.map_err(|_| Error::other("invalid signature returned by server")) EvmSignTransactionResult::Error(code) => Err(Error::other(format!(
} "server failed to sign transaction with error code {code}"
EvmSignTransactionResult::EvalError(eval_error) => Err(Error::other( ))),
ArbiterEvmSignTransactionError::PolicyEval(eval_error), }
)), }
EvmSignTransactionResult::Error(code) => Err(Error::other(format!( }
"server failed to sign transaction with error code {code}"
))),
}
}
}

4
server/crates/arbiter-client/src/wallets/mod.rs
View File

@@ -1,2 +1,2 @@
#[cfg(feature = "evm")] #[cfg(feature = "evm")]
pub mod evm; pub mod evm;

1
server/crates/arbiter-crypto/.gitignore vendored
View File

@@ -1 +0,0 @@
/target

25
server/crates/arbiter-crypto/Cargo.toml
View File

@@ -1,25 +0,0 @@
[package]
name = "arbiter-crypto"
version = "0.1.0"
edition = "2024"
[dependencies]
ml-dsa = {workspace = true, optional = true }
rand = {workspace = true, optional = true}
memsafe = {version = "0.4.0", optional = true}
hmac.workspace = true
alloy.workspace = true
x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] }
chrono.workspace = true
thiserror.workspace = true
[lints]
workspace = true
[features]
default = ["authn", "safecell"]
authn = ["dep:ml-dsa", "dep:rand"]
safecell = ["dep:memsafe"]
[lib]
doctest = false

2
server/crates/arbiter-crypto/src/authn/mod.rs
View File

@@ -1,2 +0,0 @@
pub mod v1;
pub use v1::*;

252
server/crates/arbiter-crypto/src/authn/v1.rs
View File

@@ -1,252 +0,0 @@
use chrono::{DateTime, Utc};
use hmac::digest::Digest;
use ml_dsa::{
EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature,
SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
};
use rand::RngExt;
pub static CLIENT_CONTEXT: &[u8] = b"arbiter_client";
pub static OPERATOR_CONTEXT: &[u8] = b"arbiter_operator";
const NONCE_SIZE: usize = 32;
#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
#[error("invalid length: expected {expected} bytes, got {actual} bytes")]
pub struct InvalidLength {
pub expected: usize,
pub actual: usize,
}
#[derive(Debug, Clone)]
pub struct AuthChallenge {
pub nonce: [u8; NONCE_SIZE],
pub timestamp: DateTime<Utc>,
}
impl AuthChallenge {
pub fn generate(rng: &mut impl rand::CryptoRng) -> Self {
let timestamp = Utc::now();
let nonce = {
let mut array = [0; NONCE_SIZE];
rng.fill(&mut array);
array
};
Self { nonce, timestamp }
}
pub fn format(&self) -> Vec<u8> {
{
let mut buffer = Vec::from(self.nonce);
let stamp = self
.timestamp
.timestamp_nanos_opt()
.expect("We would be long dead by the time this triggers :)");
buffer.extend_from_slice(stamp.to_be_bytes().as_slice());
buffer
}
}
pub fn from_parts(nonce: &[u8], timestamp: i64) -> Result<Self, InvalidLength> {
let random_nonce = nonce.as_array().ok_or(InvalidLength {
expected: NONCE_SIZE,
actual: nonce.len(),
})?;
Ok(Self {
nonce: *random_nonce,
timestamp: DateTime::from_timestamp_nanos(timestamp),
})
}
}
pub type KeyParams = MlDsa87;
#[derive(Clone, Debug, PartialEq)]
pub struct PublicKey(Box<MlDsaVerifyingKey<KeyParams>>);
impl crate::hashing::Hashable for PublicKey {
fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.to_bytes());
}
}
#[derive(Clone, Debug, PartialEq)]
pub struct Signature(Box<MlDsaSignature<KeyParams>>);
#[derive(Debug)]
pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>);
impl PublicKey {
pub fn to_bytes(&self) -> Vec<u8> {
self.0.encode().0.to_vec()
}
#[must_use]
pub fn verify(&self, challenge: &AuthChallenge, context: &[u8], signature: &Signature) -> bool {
let challenge = challenge.format();
self.0
.verify_with_context(&challenge, context, &signature.0)
}
}
impl Signature {
pub fn to_bytes(&self) -> Vec<u8> {
self.0.encode().0.to_vec()
}
}
impl SigningKey {
pub fn generate() -> Self {
Self(Box::new(KeyParams::key_gen(&mut rand::rng())))
}
pub fn from_seed(seed: [u8; 32]) -> Self {
Self(Box::new(KeyParams::from_seed(&Seed::from(seed))))
}
pub fn to_seed(&self) -> [u8; 32] {
self.0.to_seed().into()
}
pub fn public_key(&self) -> PublicKey {
self.0.verifying_key().into()
}
pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
self.0
.signing_key()
.sign_deterministic(message, context)
.map(Into::into)
}
pub fn sign_challenge(
&self,
challenge: &AuthChallenge,
context: &[u8],
) -> Result<Signature, Error> {
let challenge = challenge.format();
self.sign_message(&challenge, context)
}
}
impl From<MlDsaVerifyingKey<KeyParams>> for PublicKey {
fn from(value: MlDsaVerifyingKey<KeyParams>) -> Self {
Self(Box::new(value))
}
}
impl From<MlDsaSignature<KeyParams>> for Signature {
fn from(value: MlDsaSignature<KeyParams>) -> Self {
Self(Box::new(value))
}
}
impl From<MlDsaSigningKey<KeyParams>> for SigningKey {
fn from(value: MlDsaSigningKey<KeyParams>) -> Self {
Self(Box::new(value))
}
}
impl TryFrom<Vec<u8>> for PublicKey {
type Error = ();
fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> {
Self::try_from(value.as_slice())
}
}
impl TryFrom<&'_ [u8]> for PublicKey {
type Error = ();
fn try_from(value: &[u8]) -> Result<Self, Self::Error> {
let encoded = EncodedVerifyingKey::<KeyParams>::try_from(value).map_err(|_| ())?;
Ok(Self(Box::new(MlDsaVerifyingKey::decode(&encoded))))
}
}
impl TryFrom<Vec<u8>> for Signature {
type Error = ();
fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> {
Self::try_from(value.as_slice())
}
}
impl TryFrom<&'_ [u8]> for Signature {
type Error = ();
fn try_from(value: &[u8]) -> Result<Self, Self::Error> {
MlDsaSignature::try_from(value)
.map(|sig| Self(Box::new(sig)))
.map_err(|_| ())
}
}
#[cfg(test)]
mod tests {
use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _};
use crate::authn::AuthChallenge;
use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
#[test]
fn public_key_round_trip_decodes() {
let key = MlDsa87::key_gen(&mut rand::rng());
let encoded = PublicKey::from(key.verifying_key()).to_bytes();
let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode");
assert_eq!(decoded, PublicKey::from(key.verifying_key()));
}
#[test]
fn signature_round_trip_decodes() {
let key = SigningKey::generate();
let signature = key
.sign_message(b"challenge", CLIENT_CONTEXT)
.expect("signature should be created");
let decoded =
Signature::try_from(signature.to_bytes().as_slice()).expect("signature should decode");
assert_eq!(decoded, signature);
}
#[test]
fn challenge_verification_uses_context_and_canonical_key_bytes() {
let key = SigningKey::generate();
let public_key = key.public_key();
let challenge = AuthChallenge::generate(&mut rand::rng());
let signature = key
.sign_challenge(&challenge, CLIENT_CONTEXT)
.expect("signature should be created");
assert!(public_key.verify(&challenge, CLIENT_CONTEXT, &signature));
assert!(!public_key.verify(&challenge, OPERATOR_CONTEXT, &signature));
}
#[test]
fn signing_key_round_trip_seed_preserves_public_key_and_signing() {
let original = SigningKey::generate();
let restored = SigningKey::from_seed(original.to_seed());
assert_eq!(restored.public_key(), original.public_key());
let challenge = AuthChallenge::generate(&mut rand::rng());
let signature = restored
.sign_challenge(&challenge, CLIENT_CONTEXT)
.expect("signature should be created");
assert!(
restored
.public_key()
.verify(&challenge, CLIENT_CONTEXT, &signature)
);
}
}

112
server/crates/arbiter-crypto/src/hashing.rs
View File

@@ -1,112 +0,0 @@
use std::collections::HashSet;
pub use hmac::digest::Digest;
/// Deterministically hash a value by feeding its fields into the hasher in a consistent order.
#[diagnostic::on_unimplemented(
note = "for local types consider adding `#[derive(arbiter_macros::Hashable)]` to your `{Self}` type",
note = "for types from other crates check whether the crate offers a `Hashable` implementation"
)]
pub trait Hashable {
fn hash<H: Digest>(&self, hasher: &mut H);
}
macro_rules! impl_numeric {
($($t:ty),*) => {
$(
impl Hashable for $t {
fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(&self.to_be_bytes());
}
}
)*
};
}
impl_numeric!(u8, u16, u32, u64, i8, i16, i32, i64);
impl Hashable for &[u8] {
fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self);
}
}
impl Hashable for String {
fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.as_bytes());
}
}
impl<T: Hashable + PartialOrd> Hashable for Vec<T> {
fn hash<H: Digest>(&self, hasher: &mut H) {
let ref_sorted = {
let mut sorted = self.iter().collect::<Vec<_>>();
sorted.sort_by(|a, b| a.partial_cmp(b).unwrap());
sorted
};
for item in ref_sorted {
item.hash(hasher);
}
}
}
impl<T: Hashable + PartialOrd, S: std::hash::BuildHasher> Hashable for HashSet<T, S> {
fn hash<H: Digest>(&self, hasher: &mut H) {
let ref_sorted = {
let mut sorted = self.iter().collect::<Vec<_>>();
sorted.sort_by(|a, b| a.partial_cmp(b).unwrap());
sorted
};
for item in ref_sorted {
item.hash(hasher);
}
}
}
impl<T: Hashable> Hashable for Option<T> {
fn hash<H: Digest>(&self, hasher: &mut H) {
match self {
Some(value) => {
hasher.update([1]);
value.hash(hasher);
}
None => hasher.update([0]),
}
}
}
impl<T: Hashable> Hashable for Box<T> {
fn hash<H: Digest>(&self, hasher: &mut H) {
self.as_ref().hash(hasher);
}
}
impl<T: Hashable> Hashable for &T {
fn hash<H: Digest>(&self, hasher: &mut H) {
(*self).hash(hasher);
}
}
impl Hashable for alloy::primitives::Address {
fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.as_slice());
}
}
impl Hashable for alloy::primitives::U256 {
fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.to_be_bytes::<32>());
}
}
impl Hashable for chrono::Duration {
fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.num_seconds().to_be_bytes());
}
}
impl Hashable for chrono::DateTime<chrono::Utc> {
fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.timestamp_millis().to_be_bytes());
}
}

7
server/crates/arbiter-crypto/src/lib.rs
View File

@@ -1,7 +0,0 @@
#[cfg(feature = "authn")]
pub mod authn;
pub mod hashing;
#[cfg(feature = "safecell")]
pub mod safecell;
pub use x_wing;

19
server/crates/arbiter-macros/Cargo.toml
View File

@@ -1,19 +0,0 @@
[package]
name = "arbiter-macros"
version = "0.1.0"
edition = "2024"
[lib]
proc-macro = true
doctest = false
[dependencies]
proc-macro2 = "1.0"
quote = "1.0"
syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] }
[dev-dependencies]
arbiter-crypto = { path = "../arbiter-crypto" }
[lints]
workspace = true

131
server/crates/arbiter-macros/src/hashable.rs
View File

@@ -1,131 +0,0 @@
use crate::utils::{HASHABLE_TRAIT_PATH, HMAC_DIGEST_PATH};
use proc_macro2::{Span, TokenStream, TokenTree};
use quote::quote;
use syn::{DataStruct, DeriveInput, Fields, Generics, Index, parse_quote, spanned::Spanned};
pub(crate) fn derive(input: &DeriveInput) -> TokenStream {
match &input.data {
syn::Data::Struct(struct_data) => hashable_struct(input, struct_data),
syn::Data::Enum(_) => {
syn::Error::new_spanned(input, "Hashable can currently be derived only for structs")
.to_compile_error()
}
syn::Data::Union(_) => {
syn::Error::new_spanned(input, "Hashable cannot be derived for unions")
.to_compile_error()
}
}
}
fn hashable_struct(input: &DeriveInput, struct_data: &DataStruct) -> TokenStream {
let ident = &input.ident;
let hashable_trait = HASHABLE_TRAIT_PATH.to_path();
let hmac_digest = HMAC_DIGEST_PATH.to_path();
let generics = add_hashable_bounds(input.generics.clone(), &hashable_trait);
let field_accesses = collect_field_accesses(struct_data);
let hash_calls = build_hash_calls(&field_accesses, &hashable_trait);
let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
quote! {
#[automatically_derived]
impl #impl_generics #hashable_trait for #ident #ty_generics #where_clause {
fn hash<H: #hmac_digest>(&self, hasher: &mut H) {
#(#hash_calls)*
}
}
}
}
fn add_hashable_bounds(mut generics: Generics, hashable_trait: &syn::Path) -> Generics {
for type_param in generics.type_params_mut() {
type_param.bounds.push(parse_quote!(#hashable_trait));
}
generics
}
struct FieldAccess {
access: TokenStream,
span: Span,
}
fn collect_field_accesses(struct_data: &DataStruct) -> Vec<FieldAccess> {
match &struct_data.fields {
Fields::Named(fields) => {
// Keep deterministic alphabetical order for named fields.
// Do not remove this sort, because it keeps hash output stable regardless of source order.
let mut named_fields = fields
.named
.iter()
.map(|field| {
let name = field
.ident
.as_ref()
.expect("Fields::Named(fields) must have names")
.clone();
(name.to_string(), name)
})
.collect::<Vec<_>>();
named_fields.sort_by(|a, b| a.0.cmp(&b.0));
named_fields
.into_iter()
.map(|(_, name)| FieldAccess {
access: quote! { #name },
span: name.span(),
})
.collect()
}
Fields::Unnamed(fields) => fields
.unnamed
.iter()
.enumerate()
.map(|(i, field)| FieldAccess {
access: {
let index = Index::from(i);
quote! { #index }
},
span: field.ty.span(),
})
.collect(),
Fields::Unit => Vec::new(),
}
}
fn build_hash_calls(
field_accesses: &[FieldAccess],
hashable_trait: &syn::Path,
) -> Vec<TokenStream> {
field_accesses
.iter()
.map(|field| {
let access = &field.access;
let call = quote! {
#hashable_trait::hash(&self.#access, hasher);
};
respan(call, field.span)
})
.collect()
}
/// Recursively set span on all tokens, including interpolated ones.
fn respan(tokens: TokenStream, span: Span) -> TokenStream {
tokens
.into_iter()
.map(|tt| match tt {
TokenTree::Group(g) => {
let mut new = proc_macro2::Group::new(g.delimiter(), respan(g.stream(), span));
new.set_span(span);
TokenTree::Group(new)
}
mut other => {
other.set_span(span);
other
}
})
.collect()
}

10
server/crates/arbiter-macros/src/lib.rs
View File

@@ -1,10 +0,0 @@
use syn::{DeriveInput, parse_macro_input};
mod hashable;
mod utils;
#[proc_macro_derive(Hashable)]
pub fn derive_hashable(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
let input = parse_macro_input!(input as DeriveInput);
hashable::derive(&input).into()
}

24
server/crates/arbiter-macros/src/utils.rs
View File

@@ -1,24 +0,0 @@
pub(crate) struct ToPath(pub &'static str);
impl ToPath {
pub(crate) fn to_path(&self) -> syn::Path {
syn::parse_str(self.0).expect("Invalid path")
}
}
macro_rules! ensure_path {
($path:path as $name:ident) => {
const _: () = {
#[cfg(test)]
#[expect(
unused_imports,
reason = "Ensures the path is valid and will cause a compile error if not"
)]
use $path as _;
};
pub(crate) const $name: ToPath = ToPath(stringify!($path));
};
}
ensure_path!(::arbiter_crypto::hashing::Hashable as HASHABLE_TRAIT_PATH);
ensure_path!(::arbiter_crypto::hashing::Digest as HMAC_DIGEST_PATH);

71
server/crates/arbiter-proto/Cargo.toml
View File

@@ -1,35 +1,36 @@
[package] [package]
name = "arbiter-proto" name = "arbiter-proto"
version = "0.1.0" version = "0.1.0"
edition = "2024" edition = "2024"
repository = "https://git.markettakers.org/MarketTakers/arbiter" repository = "https://git.markettakers.org/MarketTakers/arbiter"
license = "Apache-2.0" license = "Apache-2.0"
[dependencies] [dependencies]
tonic.workspace = true tonic.workspace = true
tokio.workspace = true tokio.workspace = true
futures.workspace = true futures.workspace = true
tonic-prost = "0.14.5" hex = "0.4.3"
prost.workspace = true tonic-prost = "0.14.5"
kameo.workspace = true prost.workspace = true
url = "2.5.8" kameo.workspace = true
miette.workspace = true url = "2.5.8"
thiserror.workspace = true miette.workspace = true
rustls-pki-types.workspace = true thiserror.workspace = true
base64.workspace = true rustls-pki-types.workspace = true
prost-types.workspace = true base64 = "0.22.1"
async-trait.workspace = true prost-types.workspace = true
tokio-stream.workspace = true tracing.workspace = true
async-trait.workspace = true
[build-dependencies] tokio-stream.workspace = true
tonic-prost-build = "0.14.5"
[build-dependencies]
[dev-dependencies] tonic-prost-build = "0.14.5"
rstest.workspace = true protoc-bin-vendored = "3"
rcgen.workspace = true
[dev-dependencies]
[lib] rstest.workspace = true
doctest = false rand.workspace = true
rcgen.workspace = true
[package.metadata.cargo-shear]
ignored = ["tonic-prost", "prost"] [package.metadata.cargo-shear]
ignored = ["tonic-prost", "prost", "kameo"]

42
server/crates/arbiter-proto/build.rs
View File

@@ -1,21 +1,21 @@
use tonic_prost_build::configure; use tonic_prost_build::configure;
static PROTOBUF_DIR: &str = "../../../protobufs"; static PROTOBUF_DIR: &str = "../../../protobufs";
fn main() -> Result<(), Box<dyn std::error::Error>> { fn main() -> Result<(), Box<dyn std::error::Error>> {
println!("cargo::rerun-if-changed={PROTOBUF_DIR}"); println!("cargo::rerun-if-changed={PROTOBUF_DIR}");
configure() configure()
.message_attribute(".", "#[derive(::kameo::Reply)]") .message_attribute(".", "#[derive(::kameo::Reply)]")
.compile_protos( .compile_protos(
&[ &[
format!("{}/arbiter.proto", PROTOBUF_DIR), format!("{}/arbiter.proto", PROTOBUF_DIR),
format!("{}/operator.proto", PROTOBUF_DIR), format!("{}/user_agent.proto", PROTOBUF_DIR),
format!("{}/client.proto", PROTOBUF_DIR), format!("{}/client.proto", PROTOBUF_DIR),
format!("{}/evm.proto", PROTOBUF_DIR), format!("{}/evm.proto", PROTOBUF_DIR),
], ],
&[PROTOBUF_DIR.to_string()], &[PROTOBUF_DIR.to_string()],
) )
.unwrap(); .unwrap();
Ok(()) Ok(())
} }

175
server/crates/arbiter-proto/src/lib.rs
View File

@@ -1,84 +1,91 @@
pub mod transport; pub mod transport;
pub mod url; pub mod url;
pub mod proto { use base64::{Engine, prelude::BASE64_STANDARD};
tonic::include_proto!("arbiter");
pub mod proto {
pub mod shared { tonic::include_proto!("arbiter");
tonic::include_proto!("arbiter.shared");
pub mod shared {
pub mod evm { tonic::include_proto!("arbiter.shared");
tonic::include_proto!("arbiter.shared.evm");
} pub mod evm {
} tonic::include_proto!("arbiter.shared.evm");
}
pub mod operator { }
tonic::include_proto!("arbiter.operator");
pub mod user_agent {
pub mod auth { tonic::include_proto!("arbiter.user_agent");
tonic::include_proto!("arbiter.operator.auth");
} pub mod auth {
tonic::include_proto!("arbiter.user_agent.auth");
pub mod evm { }
tonic::include_proto!("arbiter.operator.evm");
} pub mod evm {
tonic::include_proto!("arbiter.user_agent.evm");
pub mod sdk_client { }
tonic::include_proto!("arbiter.operator.sdk_client");
} pub mod sdk_client {
tonic::include_proto!("arbiter.user_agent.sdk_client");
pub mod vault { }
tonic::include_proto!("arbiter.operator.vault");
pub mod vault {
pub mod bootstrap { tonic::include_proto!("arbiter.user_agent.vault");
tonic::include_proto!("arbiter.operator.vault.bootstrap");
} pub mod bootstrap {
tonic::include_proto!("arbiter.user_agent.vault.bootstrap");
pub mod unseal { }
tonic::include_proto!("arbiter.operator.vault.unseal");
} pub mod unseal {
} tonic::include_proto!("arbiter.user_agent.vault.unseal");
} }
}
pub mod client { }
tonic::include_proto!("arbiter.client");
pub mod client {
pub mod auth { tonic::include_proto!("arbiter.client");
tonic::include_proto!("arbiter.client.auth");
} pub mod auth {
tonic::include_proto!("arbiter.client.auth");
pub mod evm { }
tonic::include_proto!("arbiter.client.evm");
} pub mod evm {
tonic::include_proto!("arbiter.client.evm");
pub mod vault { }
tonic::include_proto!("arbiter.client.vault");
} pub mod vault {
} tonic::include_proto!("arbiter.client.vault");
}
pub mod evm { }
tonic::include_proto!("arbiter.evm");
} pub mod evm {
} tonic::include_proto!("arbiter.evm");
}
#[derive(Debug, Clone, PartialEq, Eq)] }
pub struct ClientMetadata {
pub name: String, #[derive(Debug, Clone, PartialEq, Eq)]
pub description: Option<String>, pub struct ClientMetadata {
pub version: Option<String>, pub name: String,
} pub description: Option<String>,
pub version: Option<String>,
pub static BOOTSTRAP_PATH: &str = "bootstrap_token"; }
pub fn home_path() -> Result<std::path::PathBuf, std::io::Error> { pub static BOOTSTRAP_PATH: &str = "bootstrap_token";
static ARBITER_HOME: &str = ".arbiter";
let home_dir = std::env::home_dir().ok_or(std::io::Error::new( pub fn home_path() -> Result<std::path::PathBuf, std::io::Error> {
std::io::ErrorKind::PermissionDenied, static ARBITER_HOME: &str = ".arbiter";
"can not get home directory", let home_dir = std::env::home_dir().ok_or(std::io::Error::new(
))?; std::io::ErrorKind::PermissionDenied,
"can not get home directory",
let arbiter_home = home_dir.join(ARBITER_HOME); ))?;
std::fs::create_dir_all(&arbiter_home)?;
let arbiter_home = home_dir.join(ARBITER_HOME);
Ok(arbiter_home) std::fs::create_dir_all(&arbiter_home)?;
}
Ok(arbiter_home)
}
pub fn format_challenge(nonce: i32, pubkey: &[u8]) -> Vec<u8> {
let concat_form = format!("{}:{}", nonce, BASE64_STANDARD.encode(pubkey));
concat_form.into_bytes()
}

381
server/crates/arbiter-proto/src/transport.rs
View File

@@ -1,218 +1,163 @@
//! Transport-facing abstractions shared by protocol/session code. //! Transport-facing abstractions shared by protocol/session code.
//! //!
//! This module defines a small set of transport traits that actors and other //! This module defines a small set of transport traits that actors and other
//! protocol code can depend on without knowing anything about the concrete //! protocol code can depend on without knowing anything about the concrete
//! transport underneath. //! transport underneath.
//! //!
//! The abstraction is split into: //! The abstraction is split into:
//! - [`Sender`] for outbound delivery //! - [`Sender`] for outbound delivery
//! - [`Receiver`] for inbound delivery //! - [`Receiver`] for inbound delivery
//! - [`Bi`] as the combined duplex form (`Sender + Receiver`) //! - [`Bi`] as the combined duplex form (`Sender + Receiver`)
//! //!
//! This split lets code depend only on the half it actually needs. For //! This split lets code depend only on the half it actually needs. For
//! example, some actor/session code only sends out-of-band messages, while //! example, some actor/session code only sends out-of-band messages, while
//! auth/state-machine code may need full duplex access. //! auth/state-machine code may need full duplex access.
//! //!
//! [`Bi`] remains intentionally minimal and transport-agnostic: //! [`Bi`] remains intentionally minimal and transport-agnostic:
//! - [`Receiver::recv`] yields inbound messages //! - [`Receiver::recv`] yields inbound messages
//! - [`Sender::send`] accepts outbound messages //! - [`Sender::send`] accepts outbound messages
//! //!
//! Transport-specific adapters, including protobuf or gRPC bridges, live in the //! Transport-specific adapters, including protobuf or gRPC bridges, live in the
//! crates that own those boundaries rather than in `arbiter-proto`. //! crates that own those boundaries rather than in `arbiter-proto`.
//! //!
//! [`Bi`] deliberately does not model request/response correlation. Some //! [`Bi`] deliberately does not model request/response correlation. Some
//! transports may carry multiplexed request/response traffic, some may emit //! transports may carry multiplexed request/response traffic, some may emit
//! out-of-band messages, and some may be one-message-at-a-time state machines. //! out-of-band messages, and some may be one-message-at-a-time state machines.
//! Correlation concerns such as request IDs, pending response maps, and //! Correlation concerns such as request IDs, pending response maps, and
//! out-of-band routing belong in the adapter or connection layer built on top //! out-of-band routing belong in the adapter or connection layer built on top
//! of [`Bi`], not in this abstraction itself. //! of [`Bi`], not in this abstraction itself.
//! //!
//! # Generic Ordering Rule //! # Generic Ordering Rule
//! //!
//! This module consistently uses `Inbound` first and `Outbound` second in //! This module consistently uses `Inbound` first and `Outbound` second in
//! generic parameter lists. //! generic parameter lists.
//! //!
//! For [`Receiver`], [`Sender`], and [`Bi`], this means: //! For [`Receiver`], [`Sender`], and [`Bi`], this means:
//! - `Receiver<Inbound>` //! - `Receiver<Inbound>`
//! - `Sender<Outbound>` //! - `Sender<Outbound>`
//! - `Bi<Inbound, Outbound>` //! - `Bi<Inbound, Outbound>`
//! //!
//! Concretely, for [`Bi`]: //! Concretely, for [`Bi`]:
//! - `recv() -> Option<Inbound>` //! - `recv() -> Option<Inbound>`
//! - `send(Outbound)` //! - `send(Outbound)`
//! //!
//! [`expect_message`] is a small helper for linear protocol steps: it reads one //! [`expect_message`] is a small helper for linear protocol steps: it reads one
//! inbound message from a transport and extracts a typed value from it, failing //! inbound message from a transport and extracts a typed value from it, failing
//! if the channel closes or the message shape is not what the caller expected. //! if the channel closes or the message shape is not what the caller expected.
//! //!
//! [`DummyTransport`] is a no-op implementation useful for tests and local //! [`DummyTransport`] is a no-op implementation useful for tests and local
//! actor execution where no real stream exists. //! actor execution where no real stream exists.
//! //!
//! # Design Notes //! # Design Notes
//! //!
//! - [`Bi::send`] returns [`Error`] only for transport delivery failures, such //! - [`Bi::send`] returns [`Error`] only for transport delivery failures, such
//! as a closed outbound channel. //! as a closed outbound channel.
//! - [`Bi::recv`] returns `None` when the underlying transport closes. //! - [`Bi::recv`] returns `None` when the underlying transport closes.
//! - Message translation is intentionally out of scope for this module. //! - Message translation is intentionally out of scope for this module.
use async_trait::async_trait;
use kameo::{error::Infallible, prelude::*}; use std::marker::PhantomData;
use std::marker::PhantomData;
use async_trait::async_trait;
/// Errors returned by transport adapters implementing [`Bi`].
#[derive(thiserror::Error, Debug)] /// Errors returned by transport adapters implementing [`Bi`].
pub enum Error { #[derive(thiserror::Error, Debug)]
#[error("Transport channel is closed")] pub enum Error {
ChannelClosed, #[error("Transport channel is closed")]
#[error("Unexpected message received")] ChannelClosed,
UnexpectedMessage, #[error("Unexpected message received")]
} UnexpectedMessage,
}
/// Receives one message from `transport` and extracts a value from it using
/// `extractor`. Returns [`Error::ChannelClosed`] if the transport closes and /// Receives one message from `transport` and extracts a value from it using
/// [`Error::UnexpectedMessage`] if `extractor` returns `None`. /// `extractor`. Returns [`Error::ChannelClosed`] if the transport closes and
pub async fn expect_message<T, Inbound, Outbound, Target, F>( /// [`Error::UnexpectedMessage`] if `extractor` returns `None`.
transport: &mut T, pub async fn expect_message<T, Inbound, Outbound, Target, F>(
extractor: F, transport: &mut T,
) -> Result<Target, Error> extractor: F,
where ) -> Result<Target, Error>
T: Bi<Inbound, Outbound> + ?Sized, where
F: FnOnce(Inbound) -> Option<Target>, T: Bi<Inbound, Outbound> + ?Sized,
{ F: FnOnce(Inbound) -> Option<Target>,
let msg = transport.recv().await.ok_or(Error::ChannelClosed)?; {
extractor(msg).ok_or(Error::UnexpectedMessage) let msg = transport.recv().await.ok_or(Error::ChannelClosed)?;
} extractor(msg).ok_or(Error::UnexpectedMessage)
}
#[async_trait]
pub trait Sender<Outbound>: Send + Sync { #[async_trait]
async fn send(&mut self, item: Outbound) -> Result<(), Error>; pub trait Sender<Outbound>: Send + Sync {
} async fn send(&mut self, item: Outbound) -> Result<(), Error>;
}
#[async_trait]
pub trait Receiver<Inbound>: Send + Sync { #[async_trait]
async fn recv(&mut self) -> Option<Inbound>; pub trait Receiver<Inbound>: Send + Sync {
} async fn recv(&mut self) -> Option<Inbound>;
}
/// Minimal bidirectional transport abstraction used by protocol code.
/// /// Minimal bidirectional transport abstraction used by protocol code.
/// `Bi<Inbound, Outbound>` is the combined duplex form of [`Sender`] and ///
/// [`Receiver`]. /// `Bi<Inbound, Outbound>` is the combined duplex form of [`Sender`] and
/// /// [`Receiver`].
/// It models a channel with: ///
/// - inbound items of type `Inbound` read via [`Bi::recv`] /// It models a channel with:
/// - outbound items of type `Outbound` written via [`Bi::send`] /// - inbound items of type `Inbound` read via [`Bi::recv`]
/// /// - outbound items of type `Outbound` written via [`Bi::send`]
/// It does not imply request/response sequencing, one-at-a-time exchange, or ///
/// any built-in correlation mechanism between inbound and outbound items. /// It does not imply request/response sequencing, one-at-a-time exchange, or
pub trait Bi<Inbound, Outbound>: Sender<Outbound> + Receiver<Inbound> + Send + Sync {} /// any built-in correlation mechanism between inbound and outbound items.
pub trait Bi<Inbound, Outbound>: Sender<Outbound> + Receiver<Inbound> + Send + Sync {}
#[async_trait]
impl<T, Outbound> Sender<Outbound> for &mut T pub trait SplittableBi<Inbound, Outbound>: Bi<Inbound, Outbound> {
where type Sender: Sender<Outbound>;
T: Sender<Outbound> + ?Sized, type Receiver: Receiver<Inbound>;
Outbound: Send + 'static,
{ fn split(self) -> (Self::Sender, Self::Receiver);
async fn send(&mut self, item: Outbound) -> Result<(), Error> { fn from_parts(sender: Self::Sender, receiver: Self::Receiver) -> Self;
(**self).send(item).await }
}
} /// No-op [`Bi`] transport for tests and manual actor usage.
///
#[async_trait] /// `send` drops all items and succeeds. [`Bi::recv`] never resolves and therefore
impl<T, Inbound> Receiver<Inbound> for &mut T /// does not busy-wait or spuriously close the stream.
where pub struct DummyTransport<Inbound, Outbound> {
T: Receiver<Inbound> + ?Sized, _marker: PhantomData<(Inbound, Outbound)>,
Inbound: Send + 'static, }
{
async fn recv(&mut self) -> Option<Inbound> { impl<Inbound, Outbound> Default for DummyTransport<Inbound, Outbound> {
(**self).recv().await fn default() -> Self {
} Self {
} _marker: PhantomData,
}
impl<T, Inbound, Outbound> Bi<Inbound, Outbound> for &mut T }
where }
T: Bi<Inbound, Outbound> + ?Sized,
Inbound: Send + 'static, #[async_trait]
Outbound: Send + 'static, impl<Inbound, Outbound> Sender<Outbound> for DummyTransport<Inbound, Outbound>
{ where
} Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static,
pub trait SplittableBi<Inbound, Outbound>: Bi<Inbound, Outbound> { {
type Sender: Sender<Outbound>; async fn send(&mut self, _item: Outbound) -> Result<(), Error> {
type Receiver: Receiver<Inbound>; Ok(())
}
fn split(self) -> (Self::Sender, Self::Receiver); }
fn from_parts(sender: Self::Sender, receiver: Self::Receiver) -> Self;
} #[async_trait]
impl<Inbound, Outbound> Receiver<Inbound> for DummyTransport<Inbound, Outbound>
/// No-op [`Bi`] transport for tests and manual actor usage. where
/// Inbound: Send + Sync + 'static,
/// `send` drops all items and succeeds. [`Bi::recv`] never resolves and therefore Outbound: Send + Sync + 'static,
/// does not busy-wait or spuriously close the stream. {
pub struct DummyTransport<Inbound, Outbound> { async fn recv(&mut self) -> Option<Inbound> {
_marker: PhantomData<(Inbound, Outbound)>, std::future::pending::<()>().await;
} None
}
impl<Inbound, Outbound> Default for DummyTransport<Inbound, Outbound> { }
fn default() -> Self {
Self { impl<Inbound, Outbound> Bi<Inbound, Outbound> for DummyTransport<Inbound, Outbound>
_marker: PhantomData, where
} Inbound: Send + Sync + 'static,
} Outbound: Send + Sync + 'static,
} {
}
#[async_trait]
impl<Inbound, Outbound> Sender<Outbound> for DummyTransport<Inbound, Outbound> pub mod grpc;
where
Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static,
{
async fn send(&mut self, _item: Outbound) -> Result<(), Error> {
Ok(())
}
}
#[async_trait]
impl<Inbound, Outbound> Receiver<Inbound> for DummyTransport<Inbound, Outbound>
where
Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static,
{
async fn recv(&mut self) -> Option<Inbound> {
std::future::pending::<()>().await;
None
}
}
impl<Inbound, Outbound> Bi<Inbound, Outbound> for DummyTransport<Inbound, Outbound>
where
Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static,
{
}
pub mod grpc;
#[derive(thiserror::Error, Debug)]
pub enum ForwardError<I> {
#[error("Transport error: {0}")]
Transport(#[from] Error),
#[error("Actor delivery error: {0}")]
Actor(SendError<I>),
}
pub async fn forward_to_actor<Transport, Inbound, Outbound, Handler>(
transport: &mut Transport,
actor: &ActorRef<Handler>,
) -> Result<(), ForwardError<Inbound>>
where
Transport: Bi<Inbound, <Outbound as Reply>::Ok>,
Handler: Actor + Message<Inbound, Reply = Outbound>,
Inbound: Send + 'static,
Outbound: Send + 'static + Reply<Error = Infallible>, // `Infallible` to enforce contract that `Outbound` carries handler-level error
{
while let Some(request) = transport.recv().await {
let resp = actor.ask(request).await.map_err(ForwardError::Actor)?;
transport.send(resp).await?
}
Err(Error::ChannelClosed.into())
}

212
server/crates/arbiter-proto/src/transport/grpc.rs
View File

@@ -1,106 +1,106 @@
use super::{Bi, Receiver, Sender}; use async_trait::async_trait;
use futures::StreamExt;
use async_trait::async_trait; use tokio::sync::mpsc;
use futures::StreamExt; use tokio_stream::wrappers::ReceiverStream;
use tokio::sync::mpsc;
use tokio_stream::wrappers::ReceiverStream; use super::{Bi, Receiver, Sender};
pub struct GrpcSender<Outbound> { pub struct GrpcSender<Outbound> {
tx: mpsc::Sender<Result<Outbound, tonic::Status>>, tx: mpsc::Sender<Result<Outbound, tonic::Status>>,
} }
#[async_trait] #[async_trait]
impl<Outbound> Sender<Result<Outbound, tonic::Status>> for GrpcSender<Outbound> impl<Outbound> Sender<Result<Outbound, tonic::Status>> for GrpcSender<Outbound>
where where
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
async fn send(&mut self, item: Result<Outbound, tonic::Status>) -> Result<(), super::Error> { async fn send(&mut self, item: Result<Outbound, tonic::Status>) -> Result<(), super::Error> {
self.tx self.tx
.send(item) .send(item)
.await .await
.map_err(|_| super::Error::ChannelClosed) .map_err(|_| super::Error::ChannelClosed)
} }
} }
pub struct GrpcReceiver<Inbound> { pub struct GrpcReceiver<Inbound> {
rx: tonic::Streaming<Inbound>, rx: tonic::Streaming<Inbound>,
} }
#[async_trait] #[async_trait]
impl<Inbound> Receiver<Result<Inbound, tonic::Status>> for GrpcReceiver<Inbound> impl<Inbound> Receiver<Result<Inbound, tonic::Status>> for GrpcReceiver<Inbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
{ {
async fn recv(&mut self) -> Option<Result<Inbound, tonic::Status>> { async fn recv(&mut self) -> Option<Result<Inbound, tonic::Status>> {
self.rx.next().await self.rx.next().await
} }
} }
pub struct GrpcBi<Inbound, Outbound> { pub struct GrpcBi<Inbound, Outbound> {
sender: GrpcSender<Outbound>, sender: GrpcSender<Outbound>,
receiver: GrpcReceiver<Inbound>, receiver: GrpcReceiver<Inbound>,
} }
impl<Inbound, Outbound> GrpcBi<Inbound, Outbound> impl<Inbound, Outbound> GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
pub fn from_bi_stream( pub fn from_bi_stream(
receiver: tonic::Streaming<Inbound>, receiver: tonic::Streaming<Inbound>,
) -> (Self, ReceiverStream<Result<Outbound, tonic::Status>>) { ) -> (Self, ReceiverStream<Result<Outbound, tonic::Status>>) {
let (tx, rx) = mpsc::channel(10); let (tx, rx) = mpsc::channel(10);
let sender = GrpcSender { tx }; let sender = GrpcSender { tx };
let receiver = GrpcReceiver { rx: receiver }; let receiver = GrpcReceiver { rx: receiver };
let bi = GrpcBi { sender, receiver }; let bi = GrpcBi { sender, receiver };
(bi, ReceiverStream::new(rx)) (bi, ReceiverStream::new(rx))
} }
} }
#[async_trait] #[async_trait]
impl<Inbound, Outbound> Sender<Result<Outbound, tonic::Status>> for GrpcBi<Inbound, Outbound> impl<Inbound, Outbound> Sender<Result<Outbound, tonic::Status>> for GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
async fn send(&mut self, item: Result<Outbound, tonic::Status>) -> Result<(), super::Error> { async fn send(&mut self, item: Result<Outbound, tonic::Status>) -> Result<(), super::Error> {
self.sender.send(item).await self.sender.send(item).await
} }
} }
#[async_trait] #[async_trait]
impl<Inbound, Outbound> Receiver<Result<Inbound, tonic::Status>> for GrpcBi<Inbound, Outbound> impl<Inbound, Outbound> Receiver<Result<Inbound, tonic::Status>> for GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
async fn recv(&mut self) -> Option<Result<Inbound, tonic::Status>> { async fn recv(&mut self) -> Option<Result<Inbound, tonic::Status>> {
self.receiver.recv().await self.receiver.recv().await
} }
} }
impl<Inbound, Outbound> Bi<Result<Inbound, tonic::Status>, Result<Outbound, tonic::Status>> impl<Inbound, Outbound> Bi<Result<Inbound, tonic::Status>, Result<Outbound, tonic::Status>>
for GrpcBi<Inbound, Outbound> for GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
} }
impl<Inbound, Outbound> impl<Inbound, Outbound>
super::SplittableBi<Result<Inbound, tonic::Status>, Result<Outbound, tonic::Status>> super::SplittableBi<Result<Inbound, tonic::Status>, Result<Outbound, tonic::Status>>
for GrpcBi<Inbound, Outbound> for GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
type Sender = GrpcSender<Outbound>; type Sender = GrpcSender<Outbound>;
type Receiver = GrpcReceiver<Inbound>; type Receiver = GrpcReceiver<Inbound>;
fn split(self) -> (Self::Sender, Self::Receiver) { fn split(self) -> (Self::Sender, Self::Receiver) {
(self.sender, self.receiver) (self.sender, self.receiver)
} }
fn from_parts(sender: Self::Sender, receiver: Self::Receiver) -> Self { fn from_parts(sender: Self::Sender, receiver: Self::Receiver) -> Self {
GrpcBi { sender, receiver } GrpcBi { sender, receiver }
} }
} }

257
server/crates/arbiter-proto/src/url.rs
View File

@@ -1,128 +1,129 @@
use base64::{Engine as _, prelude::BASE64_URL_SAFE}; use std::fmt::Display;
use rustls_pki_types::CertificateDer;
use std::fmt::Display; use base64::{Engine as _, prelude::BASE64_URL_SAFE};
use rustls_pki_types::CertificateDer;
const ARBITER_URL_SCHEME: &str = "arbiter";
const CERT_QUERY_KEY: &str = "cert"; const ARBITER_URL_SCHEME: &str = "arbiter";
const BOOTSTRAP_TOKEN_QUERY_KEY: &str = "bootstrap_token"; const CERT_QUERY_KEY: &str = "cert";
const BOOTSTRAP_TOKEN_QUERY_KEY: &str = "bootstrap_token";
#[derive(Debug, Clone)]
pub struct ArbiterUrl { #[derive(Debug, Clone)]
pub host: String, pub struct ArbiterUrl {
pub port: u16, pub host: String,
pub ca_cert: CertificateDer<'static>, pub port: u16,
pub bootstrap_token: Option<String>, pub ca_cert: CertificateDer<'static>,
} pub bootstrap_token: Option<String>,
}
impl Display for ArbiterUrl {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { impl Display for ArbiterUrl {
let mut base = format!( fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
"{ARBITER_URL_SCHEME}://{}:{}?{CERT_QUERY_KEY}={}", let mut base = format!(
self.host, "{ARBITER_URL_SCHEME}://{}:{}?{CERT_QUERY_KEY}={}",
self.port, self.host,
BASE64_URL_SAFE.encode(&self.ca_cert) self.port,
); BASE64_URL_SAFE.encode(&self.ca_cert)
if let Some(token) = &self.bootstrap_token { );
base.push_str(&format!("&{BOOTSTRAP_TOKEN_QUERY_KEY}={}", token)); if let Some(token) = &self.bootstrap_token {
} base.push_str(&format!("&{BOOTSTRAP_TOKEN_QUERY_KEY}={}", token));
f.write_str(&base) }
} f.write_str(&base)
} }
}
#[derive(Debug, thiserror::Error, miette::Diagnostic)]
pub enum Error { #[derive(Debug, thiserror::Error, miette::Diagnostic)]
#[error("Invalid URL scheme, expected '{ARBITER_URL_SCHEME}://'")] pub enum Error {
#[diagnostic( #[error("Invalid URL scheme, expected '{ARBITER_URL_SCHEME}://'")]
code(arbiter::url::invalid_scheme), #[diagnostic(
help("The URL must start with '{ARBITER_URL_SCHEME}://'") code(arbiter::url::invalid_scheme),
)] help("The URL must start with '{ARBITER_URL_SCHEME}://'")
InvalidScheme, )]
#[error("Missing host in URL")] InvalidScheme,
#[diagnostic( #[error("Missing host in URL")]
code(arbiter::url::missing_host), #[diagnostic(
help("The URL must include a host, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:<port>'") code(arbiter::url::missing_host),
)] help("The URL must include a host, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:<port>'")
MissingHost, )]
#[error("Missing port in URL")] MissingHost,
#[diagnostic( #[error("Missing port in URL")]
code(arbiter::url::missing_port), #[diagnostic(
help("The URL must include a port, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:1234'") code(arbiter::url::missing_port),
)] help("The URL must include a port, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:1234'")
MissingPort, )]
#[error("Missing 'cert' query parameter in URL")] MissingPort,
#[diagnostic( #[error("Missing 'cert' query parameter in URL")]
code(arbiter::url::missing_cert), #[diagnostic(
help("The URL must include a 'cert' query parameter") code(arbiter::url::missing_cert),
)] help("The URL must include a 'cert' query parameter")
MissingCert, )]
#[error("Invalid base64 in 'cert' query parameter: {0}")] MissingCert,
#[diagnostic(code(arbiter::url::invalid_cert_base64))] #[error("Invalid base64 in 'cert' query parameter: {0}")]
InvalidCertBase64(#[from] base64::DecodeError), #[diagnostic(code(arbiter::url::invalid_cert_base64))]
} InvalidCertBase64(#[from] base64::DecodeError),
}
impl<'a> TryFrom<&'a str> for ArbiterUrl {
type Error = Error; impl<'a> TryFrom<&'a str> for ArbiterUrl {
type Error = Error;
fn try_from(value: &'a str) -> Result<Self, Self::Error> {
let url = url::Url::parse(value).map_err(|_| Error::InvalidScheme)?; fn try_from(value: &'a str) -> Result<Self, Self::Error> {
let url = url::Url::parse(value).map_err(|_| Error::InvalidScheme)?;
if url.scheme() != ARBITER_URL_SCHEME {
return Err(Error::InvalidScheme); if url.scheme() != ARBITER_URL_SCHEME {
} return Err(Error::InvalidScheme);
}
let host = url.host_str().ok_or(Error::MissingHost)?.to_string();
let port = url.port().ok_or(Error::MissingPort)?; let host = url.host_str().ok_or(Error::MissingHost)?.to_string();
let cert_str = url let port = url.port().ok_or(Error::MissingPort)?;
.query_pairs() let cert_str = url
.find(|(k, _)| k == CERT_QUERY_KEY) .query_pairs()
.ok_or(Error::MissingCert)? .find(|(k, _)| k == CERT_QUERY_KEY)
.1; .ok_or(Error::MissingCert)?
.1;
let cert = BASE64_URL_SAFE.decode(cert_str.as_ref())?;
let cert = CertificateDer::from_slice(&cert).into_owned(); let cert = BASE64_URL_SAFE.decode(cert_str.as_ref())?;
let cert = CertificateDer::from_slice(&cert).into_owned();
let bootstrap_token = url
.query_pairs() let bootstrap_token = url
.find(|(k, _)| k == BOOTSTRAP_TOKEN_QUERY_KEY) .query_pairs()
.map(|(_, v)| v.to_string()); .find(|(k, _)| k == BOOTSTRAP_TOKEN_QUERY_KEY)
.map(|(_, v)| v.to_string());
Ok(ArbiterUrl {
host, Ok(ArbiterUrl {
port, host,
ca_cert: cert, port,
bootstrap_token, ca_cert: cert,
}) bootstrap_token,
} })
} }
}
#[cfg(test)]
mod tests { #[cfg(test)]
use rcgen::generate_simple_self_signed; mod tests {
use rstest::rstest; use rcgen::generate_simple_self_signed;
use rstest::rstest;
use super::*;
use super::*;
#[rstest]
#[rstest]
fn parsing_correctness(
#[values("127.0.0.1", "localhost", "192.168.1.1", "some.domain.com")] host: &str, fn test_parsing_correctness(
#[values("127.0.0.1", "localhost", "192.168.1.1", "some.domain.com")] host: &str,
#[values(None, Some("token123".to_string()))] bootstrap_token: Option<String>,
) { #[values(None, Some("token123".to_string()))] bootstrap_token: Option<String>,
let cert = generate_simple_self_signed(&["Arbiter CA".into()]).unwrap(); ) {
let cert = cert.cert.der(); let cert = generate_simple_self_signed(&["Arbiter CA".into()]).unwrap();
let cert = cert.cert.der();
let url = ArbiterUrl {
host: host.to_string(), let url = ArbiterUrl {
port: 1234, host: host.to_string(),
ca_cert: cert.clone().into_owned(), port: 1234,
bootstrap_token, ca_cert: cert.clone().into_owned(),
}; bootstrap_token,
let url_str = url.to_string(); };
let parsed_url = ArbiterUrl::try_from(url_str.as_str()).unwrap(); let url_str = url.to_string();
assert_eq!(url.host, parsed_url.host); let parsed_url = ArbiterUrl::try_from(url_str.as_str()).unwrap();
assert_eq!(url.port, parsed_url.port); assert_eq!(url.host, parsed_url.host);
assert_eq!(url.ca_cert.to_vec(), parsed_url.ca_cert.to_vec()); assert_eq!(url.port, parsed_url.port);
assert_eq!(url.bootstrap_token, parsed_url.bootstrap_token); assert_eq!(url.ca_cert.to_vec(), parsed_url.ca_cert.to_vec());
} assert_eq!(url.bootstrap_token, parsed_url.bootstrap_token);
} }
}

128
server/crates/arbiter-server/Cargo.toml
View File

@@ -1,61 +1,67 @@
[package] [package]
name = "arbiter-server" name = "arbiter-server"
version = "0.1.0" version = "0.1.0"
edition = "2024" edition = "2024"
repository = "https://git.markettakers.org/MarketTakers/arbiter" repository = "https://git.markettakers.org/MarketTakers/arbiter"
license = "Apache-2.0" license = "Apache-2.0"
[lints] [lints]
workspace = true workspace = true
[dependencies] [dependencies]
diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] } diesel = { version = "2.3.7", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
diesel-async = { version = "0.9.0", features = [ diesel-async = { version = "0.8.0", features = [
"bb8", "bb8",
"migrations", "migrations",
"sqlite", "sqlite",
"tokio", "tokio",
] } ] }
arbiter-proto.path = "../arbiter-proto" ed25519-dalek.workspace = true
arbiter-crypto.path = "../arbiter-crypto" ed25519-dalek.features = ["serde"]
arbiter-macros.path = "../arbiter-macros" arbiter-proto.path = "../arbiter-proto"
tracing.workspace = true tracing.workspace = true
tracing-subscriber = { version = "0.3", features = ["env-filter"] } tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tonic.workspace = true tonic.workspace = true
tonic.features = ["tls-aws-lc"] tonic.features = ["tls-aws-lc"]
tokio.workspace = true tokio.workspace = true
rustls.workspace = true rustls.workspace = true
smlang.workspace = true smlang.workspace = true
thiserror.workspace = true thiserror.workspace = true
diesel_migrations = { version = "2.3.2", features = ["sqlite"] } fatality = "0.1.1"
async-trait.workspace = true diesel_migrations = { version = "2.3.1", features = ["sqlite"] }
tokio-stream.workspace = true async-trait.workspace = true
rand.workspace = true secrecy = "0.10.3"
rcgen.workspace = true futures.workspace = true
chrono.workspace = true tokio-stream.workspace = true
kameo.workspace = true dashmap = "6.1.0"
chacha20poly1305 = { version = "0.10.1", features = ["std"] } rand.workspace = true
argon2 = { version = "0.5.3", features = ["zeroize"] } rcgen.workspace = true
restructed = "0.2.2" chrono.workspace = true
strum = { version = "0.28.0", features = ["derive"] } memsafe = "0.4.0"
pem = "3.0.6" zeroize = { version = "1.8.2", features = ["std", "simd"] }
sha2.workspace = true kameo.workspace = true
hmac.workspace = true x25519-dalek.workspace = true
alloy.workspace = true chacha20poly1305 = { version = "0.10.1", features = ["std"] }
prost-types.workspace = true argon2 = { version = "0.5.3", features = ["zeroize"] }
arbiter-tokens-registry.path = "../arbiter-tokens-registry" restructed = "0.2.2"
anyhow = "1.0.102" strum = { version = "0.28.0", features = ["derive"] }
mutants.workspace = true pem = "3.0.6"
subtle = "2.6.1" k256.workspace = true
x25519-dalek.workspace = true k256.features = ["serde"]
k256.workspace = true rsa.workspace = true
kameo_actors.workspace = true rsa.features = ["serde"]
sha2.workspace = true
[dev-dependencies] hmac = "0.12"
proptest = "1.11.0" spki.workspace = true
rstest.workspace = true alloy.workspace = true
test-log = { version = "0.2", default-features = false, features = ["trace"] } prost-types.workspace = true
ml-dsa.workspace = true prost.workspace = true
arbiter-tokens-registry.path = "../arbiter-tokens-registry"
[lib] anyhow = "1.0.102"
doctest = false postcard = { version = "1.1.3", features = ["use-std"] }
serde = { version = "1.0.228", features = ["derive"] }
serde_with = "3.18.0"
[dev-dependencies]
insta = "1.46.3"
test-log = { version = "0.2", default-features = false, features = ["trace"] }

18
server/crates/arbiter-server/diesel.toml
View File

@@ -1,9 +1,9 @@
# For documentation on how to configure this file, # For documentation on how to configure this file,
# see https://diesel.rs/guides/configuring-diesel-cli # see https://diesel.rs/guides/configuring-diesel-cli
[print_schema] [print_schema]
file = "src/db/schema.rs" file = "src/db/schema.rs"
custom_type_derives = ["diesel::query_builder::QueryId", "Clone"] custom_type_derives = ["diesel::query_builder::QueryId", "Clone"]
[migrations_directory] [migrations_directory]
dir = "migrations" dir = "migrations"

2
server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/down.sql
View File

@@ -1 +1 @@
-- This file should undo anything in `up.sql` -- This file should undo anything in `up.sql`

415
server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
View File

@@ -1,206 +1,209 @@
create table if not exists root_key_history ( create table if not exists root_key_history (
id INTEGER not null PRIMARY KEY, id INTEGER not null PRIMARY KEY,
-- root key stored as aead encrypted artifact, with only difference that it's decrypted by unseal key (derived from user password) -- root key stored as aead encrypted artifact, with only difference that it's decrypted by unseal key (derived from user password)
root_key_encryption_nonce blob not null default(1), -- if re-encrypted, this should be incremented. Used for encrypting root key root_key_encryption_nonce blob not null default(1), -- if re-encrypted, this should be incremented. Used for encrypting root key
data_encryption_nonce blob not null default(1), -- nonce used for encrypting with key itself data_encryption_nonce blob not null default(1), -- nonce used for encrypting with key itself
ciphertext blob not null, ciphertext blob not null,
tag blob not null, tag blob not null,
schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm
salt blob not null -- for key deriviation salt blob not null -- for key deriviation
) STRICT; ) STRICT;
create table if not exists aead_encrypted ( create table if not exists aead_encrypted (
id INTEGER not null PRIMARY KEY, id INTEGER not null PRIMARY KEY,
current_nonce blob not null default(1), -- if re-encrypted, this should be incremented current_nonce blob not null default(1), -- if re-encrypted, this should be incremented
ciphertext blob not null, ciphertext blob not null,
tag blob not null, tag blob not null,
schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm
associated_root_key_id integer not null references root_key_history (id) on delete RESTRICT, associated_root_key_id integer not null references root_key_history (id) on delete RESTRICT,
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create unique index if not exists uniq_nonce_per_root_key on aead_encrypted ( create unique index if not exists uniq_nonce_per_root_key on aead_encrypted (
current_nonce, current_nonce,
associated_root_key_id associated_root_key_id
); );
create table if not exists tls_history ( create table if not exists tls_history (
id INTEGER not null PRIMARY KEY, id INTEGER not null PRIMARY KEY,
cert text not null, cert text not null,
cert_key text not null, -- PEM Encoded private key cert_key text not null, -- PEM Encoded private key
ca_cert text not null, ca_cert text not null,
ca_key text not null, -- PEM Encoded private key ca_key text not null, -- PEM Encoded private key
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
-- This is a singleton -- This is a singleton
create table if not exists arbiter_settings ( create table if not exists arbiter_settings (
id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1 id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1
root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
tls_id integer references tls_history (id) on delete RESTRICT tls_id integer references tls_history (id) on delete RESTRICT
) STRICT; ) STRICT;
insert into arbiter_settings (id) values (1) on conflict do nothing; insert into arbiter_settings (id) values (1) on conflict do nothing;
-- ensure singleton row exists -- ensure singleton row exists
create table if not exists operator_client ( create table if not exists useragent_client (
id integer not null primary key, id integer not null primary key,
public_key blob not null, nonce integer not null default(1), -- used for auth challenge
created_at integer not null default(unixepoch ('now')), public_key blob not null,
updated_at integer not null default(unixepoch ('now')) key_type integer not null default(1), -- 1=Ed25519, 2=ECDSA(secp256k1)
) STRICT; created_at integer not null default(unixepoch ('now')),
create unique index if not exists uniq_operator_client_public_key on operator_client (public_key); updated_at integer not null default(unixepoch ('now'))
) STRICT;
create table if not exists client_metadata ( create unique index if not exists uniq_useragent_client_public_key on useragent_client (public_key, key_type);
id integer not null primary key,
name text not null, -- human-readable name for the client create table if not exists client_metadata (
description text, -- optional description for the client id integer not null primary key,
version text, -- client version for tracking and debugging name text not null, -- human-readable name for the client
created_at integer not null default(unixepoch ('now')) description text, -- optional description for the client
) STRICT; version text, -- client version for tracking and debugging
created_at integer not null default(unixepoch ('now'))
-- created to track history of changes ) STRICT;
create table if not exists client_metadata_history (
id integer not null primary key, -- created to track history of changes
metadata_id integer not null references client_metadata (id) on delete cascade, create table if not exists client_metadata_history (
client_id integer not null references program_client (id) on delete cascade, id integer not null primary key,
created_at integer not null default(unixepoch ('now')) metadata_id integer not null references client_metadata (id) on delete cascade,
) STRICT; client_id integer not null references program_client (id) on delete cascade,
created_at integer not null default(unixepoch ('now'))
create unique index if not exists uniq_metadata_binding_client on client_metadata_history (client_id); ) STRICT;
create table if not exists program_client ( create unique index if not exists uniq_metadata_binding_client on client_metadata_history (client_id);
id integer not null primary key,
public_key blob not null, create table if not exists program_client (
metadata_id integer not null references client_metadata (id) on delete cascade, id integer not null primary key,
created_at integer not null default(unixepoch ('now')), nonce integer not null default(1), -- used for auth challenge
updated_at integer not null default(unixepoch ('now')) public_key blob not null,
) STRICT; metadata_id integer not null references client_metadata (id) on delete cascade,
created_at integer not null default(unixepoch ('now')),
create unique index if not exists program_client_public_key_unique updated_at integer not null default(unixepoch ('now'))
on program_client (public_key); ) STRICT;
create unique index if not exists uniq_program_client_public_key on program_client (public_key); create unique index if not exists program_client_public_key_unique
on program_client (public_key);
create table if not exists evm_wallet (
id integer not null primary key, create unique index if not exists uniq_program_client_public_key on program_client (public_key);
address blob not null, -- 20-byte Ethereum address
aead_encrypted_id integer not null references aead_encrypted (id) on delete RESTRICT, create table if not exists evm_wallet (
created_at integer not null default(unixepoch ('now')) id integer not null primary key,
) STRICT; address blob not null, -- 20-byte Ethereum address
aead_encrypted_id integer not null references aead_encrypted (id) on delete RESTRICT,
create unique index if not exists uniq_evm_wallet_address on evm_wallet (address); created_at integer not null default(unixepoch ('now'))
) STRICT;
create unique index if not exists uniq_evm_wallet_aead on evm_wallet (aead_encrypted_id);
create unique index if not exists uniq_evm_wallet_address on evm_wallet (address);
create table if not exists evm_wallet_access (
id integer not null primary key, create unique index if not exists uniq_evm_wallet_aead on evm_wallet (aead_encrypted_id);
wallet_id integer not null references evm_wallet (id) on delete cascade,
client_id integer not null references program_client (id) on delete cascade, create table if not exists evm_wallet_access (
created_at integer not null default(unixepoch ('now')) id integer not null primary key,
) STRICT; wallet_id integer not null references evm_wallet (id) on delete cascade,
client_id integer not null references program_client (id) on delete cascade,
create unique index if not exists uniq_wallet_access on evm_wallet_access (wallet_id, client_id); created_at integer not null default(unixepoch ('now'))
) STRICT;
create table if not exists evm_ether_transfer_limit (
id integer not null primary key, create unique index if not exists uniq_wallet_access on evm_wallet_access (wallet_id, client_id);
window_secs integer not null, -- window duration in seconds
max_volume blob not null -- big-endian 32-byte U256 create table if not exists evm_ether_transfer_limit (
) STRICT; id integer not null primary key,
window_secs integer not null, -- window duration in seconds
-- Shared grant properties: client scope, timeframe, fee caps, and rate limit max_volume blob not null -- big-endian 32-byte U256
create table if not exists evm_basic_grant ( ) STRICT;
id integer not null primary key,
wallet_access_id integer not null references evm_wallet_access (id) on delete restrict, -- Shared grant properties: client scope, timeframe, fee caps, and rate limit
chain_id integer not null, -- EIP-155 chain ID create table if not exists evm_basic_grant (
valid_from integer, -- unix timestamp (seconds), null = no lower bound id integer not null primary key,
valid_until integer, -- unix timestamp (seconds), null = no upper bound wallet_access_id integer not null references evm_wallet_access (id) on delete restrict,
max_gas_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited chain_id integer not null, -- EIP-155 chain ID
max_priority_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited valid_from integer, -- unix timestamp (seconds), null = no lower bound
rate_limit_count integer, -- max transactions in window, null = unlimited valid_until integer, -- unix timestamp (seconds), null = no upper bound
rate_limit_window_secs integer, -- window duration in seconds, null = unlimited max_gas_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited
revoked_at integer, -- unix timestamp when revoked, null = still active max_priority_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited
created_at integer not null default(unixepoch ('now')) rate_limit_count integer, -- max transactions in window, null = unlimited
) STRICT; rate_limit_window_secs integer, -- window duration in seconds, null = unlimited
revoked_at integer, -- unix timestamp when revoked, null = still active
-- Shared transaction log for all EVM grants, used for rate limit tracking and auditing created_at integer not null default(unixepoch ('now'))
create table if not exists evm_transaction_log ( ) STRICT;
id integer not null primary key,
wallet_access_id integer not null references evm_wallet_access (id) on delete restrict, -- Shared transaction log for all EVM grants, used for rate limit tracking and auditing
grant_id integer not null references evm_basic_grant (id) on delete restrict, create table if not exists evm_transaction_log (
chain_id integer not null, id integer not null primary key,
eth_value blob not null, -- always present on any EVM tx wallet_access_id integer not null references evm_wallet_access (id) on delete restrict,
signed_at integer not null default(unixepoch ('now')) grant_id integer not null references evm_basic_grant (id) on delete restrict,
) STRICT; chain_id integer not null,
eth_value blob not null, -- always present on any EVM tx
create index if not exists idx_evm_basic_grant_access_chain on evm_basic_grant (wallet_access_id, chain_id); signed_at integer not null default(unixepoch ('now'))
) STRICT;
-- ===============================
-- ERC20 token transfer grant create index if not exists idx_evm_basic_grant_access_chain on evm_basic_grant (wallet_access_id, chain_id);
-- ===============================
create table if not exists evm_token_transfer_grant ( -- ===============================
id integer not null primary key, -- ERC20 token transfer grant
basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade, -- ===============================
token_contract blob not null, -- 20-byte ERC20 contract address create table if not exists evm_token_transfer_grant (
receiver blob -- 20-byte recipient address or null if every recipient allowed id integer not null primary key,
) STRICT; basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade,
token_contract blob not null, -- 20-byte ERC20 contract address
-- Per-window volume limits for token transfer grants receiver blob -- 20-byte recipient address or null if every recipient allowed
create table if not exists evm_token_transfer_volume_limit ( ) STRICT;
id integer not null primary key,
grant_id integer not null references evm_token_transfer_grant (id) on delete cascade, -- Per-window volume limits for token transfer grants
window_secs integer not null, -- window duration in seconds create table if not exists evm_token_transfer_volume_limit (
max_volume blob not null -- big-endian 32-byte U256 id integer not null primary key,
) STRICT; grant_id integer not null references evm_token_transfer_grant (id) on delete cascade,
window_secs integer not null, -- window duration in seconds
-- Log table for token transfer grant usage max_volume blob not null -- big-endian 32-byte U256
create table if not exists evm_token_transfer_log ( ) STRICT;
id integer not null primary key,
grant_id integer not null references evm_token_transfer_grant (id) on delete restrict, -- Log table for token transfer grant usage
log_id integer not null references evm_transaction_log (id) on delete restrict, create table if not exists evm_token_transfer_log (
chain_id integer not null, -- EIP-155 chain ID id integer not null primary key,
token_contract blob not null, -- 20-byte ERC20 contract address grant_id integer not null references evm_token_transfer_grant (id) on delete restrict,
recipient_address blob not null, -- 20-byte recipient address log_id integer not null references evm_transaction_log (id) on delete restrict,
value blob not null, -- big-endian 32-byte U256 chain_id integer not null, -- EIP-155 chain ID
created_at integer not null default(unixepoch ('now')) token_contract blob not null, -- 20-byte ERC20 contract address
) STRICT; recipient_address blob not null, -- 20-byte recipient address
value blob not null, -- big-endian 32-byte U256
create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log (grant_id); created_at integer not null default(unixepoch ('now'))
) STRICT;
create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log (log_id);
create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log (grant_id);
create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log (chain_id);
create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log (log_id);
-- ===============================
-- Ether transfer grant (uses base log) create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log (chain_id);
-- ===============================
create table if not exists evm_ether_transfer_grant ( -- ===============================
id integer not null primary key, -- Ether transfer grant (uses base log)
basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade, -- ===============================
limit_id integer not null references evm_ether_transfer_limit (id) on delete restrict create table if not exists evm_ether_transfer_grant (
) STRICT; id integer not null primary key,
basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade,
-- Specific recipient addresses for an ether transfer grant limit_id integer not null references evm_ether_transfer_limit (id) on delete restrict
create table if not exists evm_ether_transfer_grant_target ( ) STRICT;
id integer not null primary key,
grant_id integer not null references evm_ether_transfer_grant (id) on delete cascade, -- Specific recipient addresses for an ether transfer grant
address blob not null -- 20-byte recipient address create table if not exists evm_ether_transfer_grant_target (
) STRICT; id integer not null primary key,
grant_id integer not null references evm_ether_transfer_grant (id) on delete cascade,
create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target (grant_id, address); address blob not null -- 20-byte recipient address
) STRICT;
-- ===============================
-- Integrity Envelopes create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target (grant_id, address);
-- ===============================
create table if not exists integrity_envelope ( -- ===============================
id integer not null primary key, -- Integrity Envelopes
entity_kind text not null, -- ===============================
entity_id blob not null, create table if not exists integrity_envelope (
payload_version integer not null, id integer not null primary key,
key_version integer not null, entity_kind text not null,
mac blob not null, -- 20-byte recipient address entity_id blob not null,
signed_at integer not null default(unixepoch ('now')), payload_version integer not null,
created_at integer not null default(unixepoch ('now')) key_version integer not null,
) STRICT; mac blob not null, -- 20-byte recipient address
signed_at integer not null default(unixepoch ('now')),
create unique index if not exists uniq_integrity_envelope_entity on integrity_envelope (entity_kind, entity_id); created_at integer not null default(unixepoch ('now'))
) STRICT;
create unique index if not exists uniq_integrity_envelope_entity on integrity_envelope (entity_kind, entity_id);

192
server/crates/arbiter-server/src/actors/bootstrap.rs
View File

@@ -1,98 +1,94 @@
use crate::db::{self, DatabasePool, schema}; use arbiter_proto::{BOOTSTRAP_PATH, home_path};
use arbiter_proto::{BOOTSTRAP_PATH, home_path}; use diesel::QueryDsl;
use diesel_async::RunQueryDsl;
use diesel::QueryDsl; use kameo::{Actor, messages};
use diesel_async::RunQueryDsl;
use kameo::{Actor, messages}; use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng}; use thiserror::Error;
use subtle::ConstantTimeEq as _;
use thiserror::Error; use crate::db::{self, DatabasePool, schema};
const TOKEN_LENGTH: usize = 64;
const TOKEN_LENGTH: usize = 64;
pub async fn generate_token() -> Result<String, std::io::Error> {
pub async fn generate_token() -> Result<String, std::io::Error> { let rng: StdRng = make_rng();
let rng: StdRng = make_rng();
let token: String = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold( Default::default(),
String::default(), |mut accum, char| {
|mut accum, char| { accum += char.to_string().as_str();
accum += char.to_string().as_str(); accum
accum },
}, );
);
tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
Ok(token)
Ok(token) }
}
#[derive(Error, Debug)]
#[derive(Error, Debug)] pub enum Error {
pub enum Error { #[error("Database error: {0}")]
#[error("Database error: {0}")] Database(#[from] db::PoolError),
Database(#[from] db::PoolError),
#[error("Database query error: {0}")]
#[error("I/O error: {0}")] Query(#[from] diesel::result::Error),
Io(#[from] std::io::Error),
#[error("I/O error: {0}")]
#[error("Database query error: {0}")] Io(#[from] std::io::Error),
Query(#[from] diesel::result::Error), }
}
#[derive(Actor)]
#[derive(Actor)] pub struct Bootstrapper {
pub struct Bootstrapper { token: Option<String>,
token: Option<String>, }
}
impl Bootstrapper {
impl Bootstrapper { pub async fn new(db: &DatabasePool) -> Result<Self, Error> {
pub async fn new(db: &DatabasePool) -> Result<Self, Error> { let mut conn = db.get().await?;
let row_count: i64 = {
let mut conn = db.get().await?; let row_count: i64 = schema::useragent_client::table
.count()
schema::operator_client::table .get_result(&mut conn)
.count() .await?;
.get_result(&mut conn)
.await? drop(conn);
};
let token = if row_count == 0 {
let token = if row_count == 0 { let token = generate_token().await?;
let token = generate_token().await?; Some(token)
Some(token) } else {
} else { None
None };
};
Ok(Self { token })
Ok(Self { token }) }
} }
}
#[messages]
#[messages] impl Bootstrapper {
impl Bootstrapper { #[message]
#[message] pub fn is_correct_token(&self, token: String) -> bool {
pub fn is_correct_token(&self, token: String) -> bool { match &self.token {
self.token.as_ref().is_some_and(|expected| { Some(expected) => *expected == token,
let expected_bytes = expected.as_bytes(); None => false,
let token_bytes = token.as_bytes(); }
}
let choice = expected_bytes.ct_eq(token_bytes);
bool::from(choice) #[message]
}) pub fn consume_token(&mut self, token: String) -> bool {
} if self.is_correct_token(token) {
self.token = None;
#[message] true
pub fn consume_token(&mut self, token: String) -> bool { } else {
if self.is_correct_token(token) { false
self.token = None; }
true }
} else { }
false
} #[messages]
} impl Bootstrapper {
} #[message]
pub fn get_token(&self) -> Option<String> {
#[messages] self.token.clone()
impl Bootstrapper { }
#[message] }
pub fn get_token(&self) -> Option<String> {
self.token.clone()
}
}

329
server/crates/arbiter-server/src/actors/client/auth.rs Normal file
View File

@@ -0,0 +1,329 @@
use arbiter_proto::{
ClientMetadata, format_challenge,
transport::{Bi, expect_message},
};
use chrono::Utc;
use diesel::{
ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, SelectableHelper as _,
dsl::insert_into, update,
};
use diesel_async::RunQueryDsl as _;
use ed25519_dalek::{Signature, VerifyingKey};
use kameo::error::SendError;
use tracing::error;
use crate::{
actors::{
client::{ClientConnection, ClientProfile},
flow_coordinator::{self, RequestClientApproval},
},
db::{
self,
models::{ProgramClientMetadata, SqliteTimestamp},
schema::program_client,
},
};
#[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
pub enum Error {
#[error("Database pool unavailable")]
DatabasePoolUnavailable,
#[error("Database operation failed")]
DatabaseOperationFailed,
#[error("Invalid challenge solution")]
InvalidChallengeSolution,
#[error("Client approval request failed")]
ApproveError(#[from] ApproveError),
#[error("Transport error")]
Transport,
}
#[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
pub enum ApproveError {
#[error("Internal error")]
Internal,
#[error("Client connection denied by user agents")]
Denied,
#[error("Upstream error: {0}")]
Upstream(flow_coordinator::ApprovalError),
}
#[derive(Debug, Clone)]
pub enum Inbound {
AuthChallengeRequest {
pubkey: VerifyingKey,
metadata: ClientMetadata,
},
AuthChallengeSolution {
signature: Signature,
},
}
#[derive(Debug, Clone)]
pub enum Outbound {
AuthChallenge { pubkey: VerifyingKey, nonce: i32 },
AuthSuccess,
}
pub struct ClientInfo {
pub id: i32,
pub current_nonce: i32,
}
/// Atomically reads and increments the nonce for a known client.
/// Returns `None` if the pubkey is not registered.
async fn get_client_and_nonce(
db: &db::DatabasePool,
pubkey: &VerifyingKey,
) -> Result<Option<ClientInfo>, Error> {
let pubkey_bytes = pubkey.as_bytes().to_vec();
let mut conn = db.get().await.map_err(|e| {
error!(error = ?e, "Database pool error");
Error::DatabasePoolUnavailable
})?;
conn.exclusive_transaction(|conn| {
Box::pin(async move {
let Some((client_id, current_nonce)) = program_client::table
.filter(program_client::public_key.eq(&pubkey_bytes))
.select((program_client::id, program_client::nonce))
.first::<(i32, i32)>(conn)
.await
.optional()?
else {
return Result::<_, diesel::result::Error>::Ok(None);
};
update(program_client::table)
.filter(program_client::public_key.eq(&pubkey_bytes))
.set(program_client::nonce.eq(current_nonce + 1))
.execute(conn)
.await?;
Ok(Some(ClientInfo {
id: client_id,
current_nonce,
}))
})
})
.await
.map_err(|e| {
error!(error = ?e, "Database error");
Error::DatabaseOperationFailed
})
}
async fn approve_new_client(
actors: &crate::actors::GlobalActors,
profile: ClientProfile,
) -> Result<(), Error> {
let result = actors
.flow_coordinator
.ask(RequestClientApproval { client: profile })
.await;
match result {
Ok(true) => Ok(()),
Ok(false) => Err(Error::ApproveError(ApproveError::Denied)),
Err(SendError::HandlerError(e)) => {
error!(error = ?e, "Approval upstream error");
Err(Error::ApproveError(ApproveError::Upstream(e)))
}
Err(e) => {
error!(error = ?e, "Approval request to flow coordinator failed");
Err(Error::ApproveError(ApproveError::Internal))
}
}
}
async fn insert_client(
db: &db::DatabasePool,
pubkey: &VerifyingKey,
metadata: &ClientMetadata,
) -> Result<i32, Error> {
use crate::db::schema::{client_metadata, program_client};
let mut conn = db.get().await.map_err(|e| {
error!(error = ?e, "Database pool error");
Error::DatabasePoolUnavailable
})?;
let metadata_id = insert_into(client_metadata::table)
.values((
client_metadata::name.eq(&metadata.name),
client_metadata::description.eq(&metadata.description),
client_metadata::version.eq(&metadata.version),
))
.returning(client_metadata::id)
.get_result::<i32>(&mut conn)
.await
.map_err(|e| {
error!(error = ?e, "Failed to insert client metadata");
Error::DatabaseOperationFailed
})?;
let client_id = insert_into(program_client::table)
.values((
program_client::public_key.eq(pubkey.as_bytes().to_vec()),
program_client::metadata_id.eq(metadata_id),
program_client::nonce.eq(1), // pre-incremented; challenge uses 0
))
.on_conflict_do_nothing()
.returning(program_client::id)
.get_result::<i32>(&mut conn)
.await
.map_err(|e| {
error!(error = ?e, "Failed to insert client metadata");
Error::DatabaseOperationFailed
})?;
Ok(client_id)
}
async fn sync_client_metadata(
db: &db::DatabasePool,
client_id: i32,
metadata: &ClientMetadata,
) -> Result<(), Error> {
use crate::db::schema::{client_metadata, client_metadata_history};
let now = SqliteTimestamp(Utc::now());
let mut conn = db.get().await.map_err(|e| {
error!(error = ?e, "Database pool error");
Error::DatabasePoolUnavailable
})?;
conn.exclusive_transaction(|conn| {
let metadata = metadata.clone();
Box::pin(async move {
let (current_metadata_id, current): (i32, ProgramClientMetadata) =
program_client::table
.find(client_id)
.inner_join(client_metadata::table)
.select((
program_client::metadata_id,
ProgramClientMetadata::as_select(),
))
.first(conn)
.await?;
let unchanged = current.name == metadata.name
&& current.description == metadata.description
&& current.version == metadata.version;
if unchanged {
return Ok(());
}
insert_into(client_metadata_history::table)
.values((
client_metadata_history::metadata_id.eq(current_metadata_id),
client_metadata_history::client_id.eq(client_id),
))
.execute(conn)
.await?;
let metadata_id = insert_into(client_metadata::table)
.values((
client_metadata::name.eq(&metadata.name),
client_metadata::description.eq(&metadata.description),
client_metadata::version.eq(&metadata.version),
))
.returning(client_metadata::id)
.get_result::<i32>(conn)
.await?;
update(program_client::table.find(client_id))
.set((
program_client::metadata_id.eq(metadata_id),
program_client::updated_at.eq(now),
))
.execute(conn)
.await?;
Ok::<(), diesel::result::Error>(())
})
})
.await
.map_err(|e| {
error!(error = ?e, "Database error");
Error::DatabaseOperationFailed
})
}
async fn challenge_client<T>(
transport: &mut T,
pubkey: VerifyingKey,
nonce: i32,
) -> Result<(), Error>
where
T: Bi<Inbound, Result<Outbound, Error>> + ?Sized,
{
transport
.send(Ok(Outbound::AuthChallenge { pubkey, nonce }))
.await
.map_err(|e| {
error!(error = ?e, "Failed to send auth challenge");
Error::Transport
})?;
let signature = expect_message(transport, |req: Inbound| match req {
Inbound::AuthChallengeSolution { signature } => Some(signature),
_ => None,
})
.await
.map_err(|e| {
error!(error = ?e, "Failed to receive challenge solution");
Error::Transport
})?;
let formatted = format_challenge(nonce, pubkey.as_bytes());
pubkey.verify_strict(&formatted, &signature).map_err(|_| {
error!("Challenge solution verification failed");
Error::InvalidChallengeSolution
})?;
Ok(())
}
pub async fn authenticate<T>(props: &mut ClientConnection, transport: &mut T) -> Result<i32, Error>
where
T: Bi<Inbound, Result<Outbound, Error>> + Send + ?Sized,
{
let Some(Inbound::AuthChallengeRequest { pubkey, metadata }) = transport.recv().await else {
return Err(Error::Transport);
};
let info = match get_client_and_nonce(&props.db, &pubkey).await? {
Some(nonce) => nonce,
None => {
approve_new_client(
&props.actors,
ClientProfile {
pubkey,
metadata: metadata.clone(),
},
)
.await?;
let client_id = insert_client(&props.db, &pubkey, &metadata).await?;
ClientInfo {
id: client_id,
current_nonce: 0,
}
}
};
sync_client_metadata(&props.db, info.id, &metadata).await?;
challenge_client(transport, pubkey, info.current_nonce).await?;
transport
.send(Ok(Outbound::AuthSuccess))
.await
.map_err(|e| {
error!(error = ?e, "Failed to send auth success");
Error::Transport
})?;
Ok(info.id)
}

100
server/crates/arbiter-server/src/peers/client/mod.rs → server/crates/arbiter-server/src/actors/client/mod.rs
View File

@@ -1,56 +1,44 @@
use crate::{ use arbiter_proto::{ClientMetadata, transport::Bi};
actors::GlobalActors, crypto::integrity::Integrable, db, peers::client::session::ClientSession, use kameo::actor::Spawn;
}; use tracing::{error, info};
use arbiter_crypto::authn;
use arbiter_macros::Hashable; use crate::{
use arbiter_proto::{ClientMetadata, transport::Bi}; actors::{GlobalActors, client::session::ClientSession},
db,
use kameo::actor::Spawn; };
use tracing::{error, info};
#[derive(Debug, Clone)]
#[derive(Debug, Clone)] pub struct ClientProfile {
pub struct ClientProfile { pub pubkey: ed25519_dalek::VerifyingKey,
pub pubkey: authn::PublicKey, pub metadata: ClientMetadata,
pub metadata: ClientMetadata, }
}
pub struct ClientConnection {
#[derive(Hashable)] pub(crate) db: db::DatabasePool,
pub struct ClientCredentials { pub(crate) actors: GlobalActors,
pub pubkey: authn::PublicKey, }
}
impl ClientConnection {
impl Integrable for ClientCredentials { pub fn new(db: db::DatabasePool, actors: GlobalActors) -> Self {
const KIND: &'static str = "client_credentials"; Self { db, actors }
} }
}
pub struct ClientConnection {
pub(crate) db: db::DatabasePool, pub mod auth;
pub(crate) actors: GlobalActors, pub mod session;
}
pub async fn connect_client<T>(mut props: ClientConnection, transport: &mut T)
impl ClientConnection { where
pub const fn new(db: db::DatabasePool, actors: GlobalActors) -> Self { T: Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> + Send + ?Sized,
Self { db, actors } {
} match auth::authenticate(&mut props, transport).await {
} Ok(client_id) => {
ClientSession::spawn(ClientSession::new(props, client_id));
pub mod auth; info!("Client authenticated, session started");
pub mod session; }
Err(err) => {
pub async fn connect_client<T>(mut props: ClientConnection, transport: &mut T) let _ = transport.send(Err(err.clone())).await;
where error!(?err, "Authentication failed, closing connection");
T: Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> + Send + ?Sized, }
{ }
let fut = auth::authenticate(&mut props, transport); }
println!("authenticate future size: {}", size_of_val(&fut));
match fut.await {
Ok(client_id) => {
ClientSession::spawn(ClientSession::new(props, client_id));
info!("Client authenticated, session started");
}
Err(err) => {
let _ = transport.send(Err(err.clone())).await;
error!(?err, "Authentication failed, closing connection");
}
}
}

237
server/crates/arbiter-server/src/peers/client/session.rs → server/crates/arbiter-server/src/actors/client/session.rs
View File

@@ -1,118 +1,119 @@
use super::ClientConnection; use kameo::{Actor, messages};
use crate::{ use tracing::error;
actors::{
GlobalActors, use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
evm::{ClientSignTransaction, SignTransactionError},
flow_coordinator::RegisterClient, use crate::{
vault::VaultState, actors::{
}, GlobalActors,
db, client::ClientConnection,
evm::VetError, evm::{ClientSignTransaction, SignTransactionError},
}; flow_coordinator::RegisterClient,
keyholder::KeyHolderState,
use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature}; },
use kameo::{Actor, messages}; db,
use tracing::error; evm::VetError,
};
pub struct ClientSession {
props: ClientConnection, pub struct ClientSession {
client_id: i32, props: ClientConnection,
} client_id: i32,
}
impl ClientSession {
pub(crate) const fn new(props: ClientConnection, client_id: i32) -> Self { impl ClientSession {
Self { props, client_id } pub(crate) fn new(props: ClientConnection, client_id: i32) -> Self {
} Self { props, client_id }
} }
}
#[messages]
impl ClientSession { #[messages]
#[message] impl ClientSession {
pub(crate) async fn handle_query_vault_state(&mut self) -> Result<VaultState, Error> { #[message]
use crate::actors::vault::GetState; pub(crate) async fn handle_query_vault_state(&mut self) -> Result<KeyHolderState, Error> {
use crate::actors::keyholder::GetState;
let vault_state = match self.props.actors.vault.ask(GetState {}).await {
Ok(state) => state, let vault_state = match self.props.actors.key_holder.ask(GetState {}).await {
Err(err) => { Ok(state) => state,
error!(?err, actor = "client", "vault.query.failed"); Err(err) => {
return Err(Error::Internal); error!(?err, actor = "client", "keyholder.query.failed");
} return Err(Error::Internal);
}; }
};
Ok(vault_state)
} Ok(vault_state)
}
#[message]
pub(crate) async fn handle_sign_transaction( #[message]
&mut self, pub(crate) async fn handle_sign_transaction(
wallet_address: Address, &mut self,
transaction: TxEip1559, wallet_address: Address,
) -> Result<Signature, SignTransactionRpcError> { transaction: TxEip1559,
match self ) -> Result<Signature, SignTransactionRpcError> {
.props match self
.actors .props
.evm .actors
.ask(ClientSignTransaction { .evm
client_id: self.client_id, .ask(ClientSignTransaction {
wallet_address, client_id: self.client_id,
transaction, wallet_address,
}) transaction,
.await })
{ .await
Ok(signature) => Ok(signature), {
Err(kameo::error::SendError::HandlerError(SignTransactionError::Vet(vet_error))) => { Ok(signature) => Ok(signature),
Err(SignTransactionRpcError::Vet(vet_error)) Err(kameo::error::SendError::HandlerError(SignTransactionError::Vet(vet_error))) => {
} Err(SignTransactionRpcError::Vet(vet_error))
Err(err) => { }
error!(?err, "Failed to sign EVM transaction in client session"); Err(err) => {
Err(SignTransactionRpcError::Internal) error!(?err, "Failed to sign EVM transaction in client session");
} Err(SignTransactionRpcError::Internal)
} }
} }
} }
}
impl Actor for ClientSession {
type Args = Self; impl Actor for ClientSession {
type Args = Self;
type Error = Error;
type Error = Error;
async fn on_start(
args: Self::Args, async fn on_start(
this: kameo::prelude::ActorRef<Self>, args: Self::Args,
) -> Result<Self, Self::Error> { this: kameo::prelude::ActorRef<Self>,
args.props ) -> Result<Self, Self::Error> {
.actors args.props
.flow_coordinator .actors
.ask(RegisterClient { actor: this }) .flow_coordinator
.await .ask(RegisterClient { actor: this })
.map_err(|_| Error::ConnectionRegistrationFailed)?; .await
Ok(args) .map_err(|_| Error::ConnectionRegistrationFailed)?;
} Ok(args)
} }
}
impl ClientSession {
pub const fn new_test(db: db::DatabasePool, actors: GlobalActors) -> Self { impl ClientSession {
let props = ClientConnection::new(db, actors); pub fn new_test(db: db::DatabasePool, actors: GlobalActors) -> Self {
Self { let props = ClientConnection::new(db, actors);
props, Self {
client_id: 0, props,
} client_id: 0,
} }
} }
}
#[derive(Debug, thiserror::Error)]
pub enum Error { #[derive(Debug, thiserror::Error)]
#[error("Connection registration failed")] pub enum Error {
ConnectionRegistrationFailed, #[error("Connection registration failed")]
#[error("Internal error")] ConnectionRegistrationFailed,
Internal, #[error("Internal error")]
} Internal,
}
#[derive(Debug, thiserror::Error)]
pub enum SignTransactionRpcError { #[derive(Debug, thiserror::Error)]
#[error("Policy evaluation failed")] pub enum SignTransactionRpcError {
Vet(#[from] VetError), #[error("Policy evaluation failed")]
Vet(#[from] VetError),
#[error("Internal error")]
Internal, #[error("Internal error")]
} Internal,
}

624
server/crates/arbiter-server/src/actors/evm/mod.rs
View File

@@ -1,260 +1,364 @@
use crate::{ use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
actors::vault::{CreateNew, Decrypt, Vault}, use diesel::{
crypto::integrity, BoolExpressionMethods as _, ExpressionMethods, OptionalExtension as _, QueryDsl,
db::{ SelectableHelper as _, dsl::insert_into,
DatabaseError, DatabasePool, };
models::{self}, use diesel_async::{AsyncConnection as _, RunQueryDsl};
schema, use kameo::{Actor, actor::ActorRef, messages};
}, use rand::{SeedableRng, rng, rngs::StdRng};
evm::{
self, ListError, RunKind, use crate::{
policies::{ actors::keyholder::{CreateNew, Decrypt, KeyHolder},
CombinedSettings, Grant, SharedGrantSettings, SpecificGrant, SpecificMeaning, crypto::integrity,
ether_transfer::EtherTransfer, token_transfers::TokenTransfer, db::{
}, DatabaseError, DatabasePool,
}, models::{self},
}; schema,
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _}; },
evm::{
use alloy::{ self, ListError, RunKind,
consensus::TxEip1559, network::TxSignerSync as _, primitives::Address, signers::Signature, policies::{
}; CombinedSettings, Grant, SharedGrantSettings, SpecificGrant, SpecificMeaning,
use diesel::{ ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into, },
}; },
use diesel_async::RunQueryDsl; safe_cell::{SafeCell, SafeCellHandle as _},
use kameo::{Actor, actor::ActorRef, messages}; };
use rand::{SeedableRng, rng, rngs::StdRng};
pub use crate::evm::safe_signer;
pub use crate::evm::safe_signer;
#[derive(Debug, thiserror::Error)]
#[derive(Debug, thiserror::Error)] pub enum SignTransactionError {
pub enum SignTransactionError { #[error("Wallet not found")]
#[error("Wallet not found")] WalletNotFound,
WalletNotFound,
#[error("Database error: {0}")]
#[error("Database error: {0}")] Database(#[from] DatabaseError),
Database(#[from] DatabaseError),
#[error("Keyholder error: {0}")]
#[error("Vault error: {0}")] Keyholder(#[from] crate::actors::keyholder::Error),
Vault(#[from] crate::actors::vault::Error),
#[error("Keyholder mailbox error")]
#[error("Vault mailbox error")] KeyholderSend,
VaultSend,
#[error("Signing error: {0}")]
#[error("Signing error: {0}")] Signing(#[from] alloy::signers::Error),
Signing(#[from] alloy::signers::Error),
#[error("Policy error: {0}")]
#[error("Policy error: {0}")] Vet(#[from] evm::VetError),
Vet(#[from] evm::VetError), }
}
#[derive(Debug, thiserror::Error)]
#[derive(Debug, thiserror::Error)] pub enum Error {
pub enum Error { #[error("Keyholder error: {0}")]
#[error("Vault error: {0}")] Keyholder(#[from] crate::actors::keyholder::Error),
Vault(#[from] crate::actors::vault::Error),
#[error("Keyholder mailbox error")]
#[error("Vault mailbox error")] KeyholderSend,
VaultSend,
#[error("Database error: {0}")]
#[error("Database error: {0}")] Database(#[from] DatabaseError),
Database(#[from] DatabaseError),
#[error("Integrity violation: {0}")]
#[error("Integrity violation: {0}")] Integrity(#[from] integrity::Error),
Integrity(#[from] integrity::Error), }
}
#[derive(Actor)]
#[derive(Actor)] pub struct EvmActor {
pub struct EvmActor { pub keyholder: ActorRef<KeyHolder>,
pub vault: ActorRef<Vault>, pub db: DatabasePool,
pub db: DatabasePool, pub rng: StdRng,
pub rng: StdRng, pub engine: evm::Engine,
pub engine: evm::Engine, }
}
impl EvmActor {
impl EvmActor { pub fn new(keyholder: ActorRef<KeyHolder>, db: DatabasePool) -> Self {
pub fn new(vault: ActorRef<Vault>, db: DatabasePool) -> Self { // is it safe to seed rng from system once?
// is it safe to seed rng from system once? // todo: audit
// todo: audit let rng = StdRng::from_rng(&mut rng());
let rng = StdRng::from_rng(&mut rng()); let engine = evm::Engine::new(db.clone(), keyholder.clone());
let engine = evm::Engine::new(db.clone(), vault.clone()); Self {
Self { keyholder,
vault, db,
db, rng,
rng, engine,
engine, }
} }
} }
}
#[messages]
#[messages] impl EvmActor {
impl EvmActor { #[message]
#[message] pub async fn generate(&mut self) -> Result<(i32, Address), Error> {
pub async fn generate(&mut self) -> Result<(i32, Address), Error> { let (mut key_cell, address) = safe_signer::generate(&mut self.rng);
let (mut key_cell, address) = safe_signer::generate(&mut self.rng);
let plaintext = key_cell.read_inline(|reader| SafeCell::new(reader.to_vec()));
let plaintext = key_cell.read_inline(|reader| SafeCell::new(reader.to_vec()));
let aead_id: i32 = self
let aead_id: i32 = self .keyholder
.vault .ask(CreateNew { plaintext })
.ask(CreateNew { plaintext }) .await
.await .map_err(|_| Error::KeyholderSend)?;
.map_err(|_| Error::VaultSend)?;
let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let mut conn = self.db.get().await.map_err(DatabaseError::from)?; let wallet_id = insert_into(schema::evm_wallet::table)
let wallet_id = insert_into(schema::evm_wallet::table) .values(&models::NewEvmWallet {
.values(&models::NewEvmWallet { address: address.as_slice().to_vec(),
address: address.as_slice().to_vec(), aead_encrypted_id: aead_id,
aead_encrypted_id: aead_id, })
}) .returning(schema::evm_wallet::id)
.returning(schema::evm_wallet::id) .get_result(&mut conn)
.get_result(&mut conn) .await
.await .map_err(DatabaseError::from)?;
.map_err(DatabaseError::from)?;
Ok((wallet_id, address))
Ok((wallet_id, address)) }
}
#[message]
#[message] pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> { let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let mut conn = self.db.get().await.map_err(DatabaseError::from)?; let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
let rows: Vec<models::EvmWallet> = schema::evm_wallet::table .select(models::EvmWallet::as_select())
.select(models::EvmWallet::as_select()) .load(&mut conn)
.load(&mut conn) .await
.await .map_err(DatabaseError::from)?;
.map_err(DatabaseError::from)?;
Ok(rows
Ok(rows .into_iter()
.into_iter() .map(|w| (w.id, Address::from_slice(&w.address)))
.map(|w| (w.id, Address::from_slice(&w.address))) .collect())
.collect()) }
} }
}
#[messages]
#[messages] impl EvmActor {
impl EvmActor { #[message]
#[message] pub async fn useragent_create_grant(
pub async fn operator_create_grant( &mut self,
&mut self, basic: SharedGrantSettings,
basic: SharedGrantSettings, grant: SpecificGrant,
grant: SpecificGrant, ) -> Result<i32, Error> {
) -> Result<i32, Error> { match grant {
match grant { SpecificGrant::EtherTransfer(settings) => self
SpecificGrant::EtherTransfer(settings) => self .engine
.engine .create_grant::<EtherTransfer>(CombinedSettings {
.create_grant::<EtherTransfer>(CombinedSettings { shared: basic,
shared: basic, specific: settings,
specific: settings, })
}) .await
.await .map_err(Error::from),
.map_err(Error::from), SpecificGrant::TokenTransfer(settings) => self
SpecificGrant::TokenTransfer(settings) => self .engine
.engine .create_grant::<TokenTransfer>(CombinedSettings {
.create_grant::<TokenTransfer>(CombinedSettings { shared: basic,
shared: basic, specific: settings,
specific: settings, })
}) .await
.await .map_err(Error::from),
.map_err(Error::from), }
} }
}
#[message]
#[message] pub async fn useragent_delete_grant(&mut self, grant_id: i32) -> Result<(), Error> {
pub async fn useragent_delete_grant( let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
&mut self,
grant_id: i32, // We intentionally perform a hard delete here to avoid leaving revoked grants and their
) -> Result<(), Error> { // related rows as long-lived DB garbage. We also don't rely on SQLite FK cascades because
self.engine // they can be disabled per-connection.
.revoke_grant(grant_id) conn.transaction(|conn| {
.await Box::pin(async move {
.map_err(Error::from) // First, resolve policy-specific rows by basic grant id.
} let token_grant_id: Option<i32> = schema::evm_token_transfer_grant::table
.select(schema::evm_token_transfer_grant::id)
#[message] .filter(schema::evm_token_transfer_grant::basic_grant_id.eq(grant_id))
pub async fn operator_list_grants(&mut self) -> Result<Vec<Grant<SpecificGrant>>, Error> { .first::<i32>(conn)
match self.engine.list_all_grants().await { .await
Ok(grants) => Ok(grants), .optional()?;
Err(ListError::Database(db_err)) => Err(Error::Database(db_err)),
Err(ListError::Integrity(integrity_err)) => Err(Error::Integrity(integrity_err)), let ether_grant: Option<(i32, i32)> = schema::evm_ether_transfer_grant::table
} .select((
} schema::evm_ether_transfer_grant::id,
schema::evm_ether_transfer_grant::limit_id,
#[message] ))
pub async fn shared_analyze_transaction( .filter(schema::evm_ether_transfer_grant::basic_grant_id.eq(grant_id))
&mut self, .first::<(i32, i32)>(conn)
client_id: i32, .await
wallet_address: Address, .optional()?;
transaction: TxEip1559,
) -> Result<SpecificMeaning, SignTransactionError> { // Token-transfer: logs must be deleted before transaction logs (FK restrict).
let mut conn = self.db.get().await.map_err(DatabaseError::from)?; if let Some(token_grant_id) = token_grant_id {
let wallet = schema::evm_wallet::table diesel::delete(
.select(models::EvmWallet::as_select()) schema::evm_token_transfer_log::table
.filter(schema::evm_wallet::address.eq(wallet_address.as_slice())) .filter(schema::evm_token_transfer_log::grant_id.eq(token_grant_id)),
.first(&mut conn) )
.await .execute(conn)
.optional() .await?;
.map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?; diesel::delete(schema::evm_token_transfer_volume_limit::table.filter(
let wallet_access = schema::evm_wallet_access::table schema::evm_token_transfer_volume_limit::grant_id.eq(token_grant_id),
.select(models::EvmWalletAccess::as_select()) ))
.filter(schema::evm_wallet_access::wallet_id.eq(wallet.id)) .execute(conn)
.filter(schema::evm_wallet_access::client_id.eq(client_id)) .await?;
.first(&mut conn)
.await diesel::delete(
.optional() schema::evm_token_transfer_grant::table
.map_err(DatabaseError::from)? .filter(schema::evm_token_transfer_grant::id.eq(token_grant_id)),
.ok_or(SignTransactionError::WalletNotFound)?; )
drop(conn); .execute(conn)
.await?;
let meaning = self }
.engine
.evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution) // Shared transaction logs for any grant kind.
.await?; diesel::delete(
schema::evm_transaction_log::table
Ok(meaning) .filter(schema::evm_transaction_log::grant_id.eq(grant_id)),
} )
.execute(conn)
#[message] .await?;
pub async fn client_sign_transaction(
&mut self, // Ether-transfer: delete targets, grant row, then its limit row.
client_id: i32, if let Some((ether_grant_id, limit_id)) = ether_grant {
wallet_address: Address, diesel::delete(schema::evm_ether_transfer_grant_target::table.filter(
mut transaction: TxEip1559, schema::evm_ether_transfer_grant_target::grant_id.eq(ether_grant_id),
) -> Result<Signature, SignTransactionError> { ))
let mut conn = self.db.get().await.map_err(DatabaseError::from)?; .execute(conn)
let wallet = schema::evm_wallet::table .await?;
.select(models::EvmWallet::as_select())
.filter(schema::evm_wallet::address.eq(wallet_address.as_slice())) diesel::delete(
.first(&mut conn) schema::evm_ether_transfer_grant::table
.await .filter(schema::evm_ether_transfer_grant::id.eq(ether_grant_id)),
.optional() )
.map_err(DatabaseError::from)? .execute(conn)
.ok_or(SignTransactionError::WalletNotFound)?; .await?;
let wallet_access = schema::evm_wallet_access::table
.select(models::EvmWalletAccess::as_select()) diesel::delete(
.filter(schema::evm_wallet_access::wallet_id.eq(wallet.id)) schema::evm_ether_transfer_limit::table
.filter(schema::evm_wallet_access::client_id.eq(client_id)) .filter(schema::evm_ether_transfer_limit::id.eq(limit_id)),
.first(&mut conn) )
.await .execute(conn)
.optional() .await?;
.map_err(DatabaseError::from)? }
.ok_or(SignTransactionError::WalletNotFound)?;
drop(conn); // Integrity envelopes are not FK-constrained; delete only grant-related kinds to
// avoid accidentally deleting other entities that share the same integer ID.
let raw_key: SafeCell<Vec<u8>> = self let entity_id = grant_id.to_be_bytes().to_vec();
.vault diesel::delete(
.ask(Decrypt { schema::integrity_envelope::table
aead_id: wallet.aead_encrypted_id, .filter(schema::integrity_envelope::entity_id.eq(entity_id))
}) .filter(
.await schema::integrity_envelope::entity_kind
.map_err(|_| SignTransactionError::VaultSend)?; .eq("EtherTransfer")
.or(schema::integrity_envelope::entity_kind.eq("TokenTransfer")),
let signer = safe_signer::SafeSigner::from_cell(raw_key)?; ),
)
self.engine .execute(conn)
.evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution) .await?;
.await?;
// Finally remove the basic grant row itself (idempotent if it doesn't exist).
Ok(signer.sign_transaction_sync(&mut transaction)?) diesel::delete(
} schema::evm_basic_grant::table.filter(schema::evm_basic_grant::id.eq(grant_id)),
} )
.execute(conn)
.await?;
diesel::result::QueryResult::Ok(())
})
})
.await
.map_err(DatabaseError::from)?;
Ok(())
}
#[message]
pub async fn useragent_list_grants(&mut self) -> Result<Vec<Grant<SpecificGrant>>, Error> {
match self.engine.list_all_grants().await {
Ok(grants) => Ok(grants),
Err(ListError::Database(db_err)) => Err(Error::Database(db_err)),
Err(ListError::Integrity(integrity_err)) => Err(Error::Integrity(integrity_err)),
}
}
#[message]
pub async fn shared_analyze_transaction(
&mut self,
client_id: i32,
wallet_address: Address,
transaction: TxEip1559,
) -> Result<SpecificMeaning, SignTransactionError> {
let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let wallet = schema::evm_wallet::table
.select(models::EvmWallet::as_select())
.filter(schema::evm_wallet::address.eq(wallet_address.as_slice()))
.first(&mut conn)
.await
.optional()
.map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?;
let wallet_access = schema::evm_wallet_access::table
.select(models::EvmWalletAccess::as_select())
.filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
.filter(schema::evm_wallet_access::client_id.eq(client_id))
.first(&mut conn)
.await
.optional()
.map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?;
drop(conn);
let meaning = self
.engine
.evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
.await?;
Ok(meaning)
}
#[message]
pub async fn client_sign_transaction(
&mut self,
client_id: i32,
wallet_address: Address,
mut transaction: TxEip1559,
) -> Result<Signature, SignTransactionError> {
let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let wallet = schema::evm_wallet::table
.select(models::EvmWallet::as_select())
.filter(schema::evm_wallet::address.eq(wallet_address.as_slice()))
.first(&mut conn)
.await
.optional()
.map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?;
let wallet_access = schema::evm_wallet_access::table
.select(models::EvmWalletAccess::as_select())
.filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
.filter(schema::evm_wallet_access::client_id.eq(client_id))
.first(&mut conn)
.await
.optional()
.map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?;
drop(conn);
let raw_key: SafeCell<Vec<u8>> = self
.keyholder
.ask(Decrypt {
aead_id: wallet.aead_encrypted_id,
})
.await
.map_err(|_| SignTransactionError::KeyholderSend)?;
let signer = safe_signer::SafeSigner::from_cell(raw_key)?;
self.engine
.evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
.await?;
use alloy::network::TxSignerSync as _;
Ok(signer.sign_transaction_sync(&mut transaction)?)
}
}
#[cfg(test)]
mod tests;

283
server/crates/arbiter-server/src/actors/evm/tests.rs Normal file
View File

@@ -0,0 +1,283 @@
use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
use diesel_async::RunQueryDsl;
use kameo::actor::Spawn as _;
use crate::{
actors::{evm::EvmActor, keyholder::KeyHolder},
db::{self, models, schema},
};
#[tokio::test]
async fn delete_ether_grant_cleans_related_tables() {
let db = db::create_test_pool().await;
let keyholder = KeyHolder::spawn(KeyHolder::new(db.clone()).await.unwrap());
let mut actor = EvmActor::new(keyholder, db.clone());
let mut conn = db.get().await.unwrap();
let basic_id: i32 = insert_into(schema::evm_basic_grant::table)
.values(&models::NewEvmBasicGrant {
wallet_access_id: 1,
chain_id: 1,
valid_from: None,
valid_until: None,
max_gas_fee_per_gas: None,
max_priority_fee_per_gas: None,
rate_limit_count: None,
rate_limit_window_secs: None,
revoked_at: None,
})
.returning(schema::evm_basic_grant::id)
.get_result(&mut conn)
.await
.unwrap();
let limit_id: i32 = insert_into(schema::evm_ether_transfer_limit::table)
.values(&models::NewEvmEtherTransferLimit {
window_secs: 60,
max_volume: vec![1],
})
.returning(schema::evm_ether_transfer_limit::id)
.get_result(&mut conn)
.await
.unwrap();
let ether_grant_id: i32 = insert_into(schema::evm_ether_transfer_grant::table)
.values(&models::NewEvmEtherTransferGrant {
basic_grant_id: basic_id,
limit_id,
})
.returning(schema::evm_ether_transfer_grant::id)
.get_result(&mut conn)
.await
.unwrap();
insert_into(schema::evm_ether_transfer_grant_target::table)
.values(&models::NewEvmEtherTransferGrantTarget {
grant_id: ether_grant_id,
address: vec![0u8; 20],
})
.execute(&mut conn)
.await
.unwrap();
insert_into(schema::evm_transaction_log::table)
.values(&models::NewEvmTransactionLog {
grant_id: basic_id,
wallet_access_id: 1,
chain_id: 1,
eth_value: vec![0],
signed_at: models::SqliteTimestamp::now(),
})
.execute(&mut conn)
.await
.unwrap();
insert_into(schema::integrity_envelope::table)
.values(&models::NewIntegrityEnvelope {
entity_kind: "EtherTransfer".to_owned(),
entity_id: basic_id.to_be_bytes().to_vec(),
payload_version: 1,
key_version: 1,
mac: vec![0u8; 32],
})
.execute(&mut conn)
.await
.unwrap();
drop(conn);
actor.useragent_delete_grant(basic_id).await.unwrap();
// Idempotency: second delete should be a no-op.
actor.useragent_delete_grant(basic_id).await.unwrap();
let mut conn = db.get().await.unwrap();
let basic_count: i64 = schema::evm_basic_grant::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(basic_count, 0);
let ether_grant_count: i64 = schema::evm_ether_transfer_grant::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(ether_grant_count, 0);
let target_count: i64 = schema::evm_ether_transfer_grant_target::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(target_count, 0);
let limit_count: i64 = schema::evm_ether_transfer_limit::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(limit_count, 0);
let log_count: i64 = schema::evm_transaction_log::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(log_count, 0);
let envelope_count: i64 = schema::integrity_envelope::table
.filter(schema::integrity_envelope::entity_kind.eq("EtherTransfer"))
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(envelope_count, 0);
}
#[tokio::test]
async fn delete_token_grant_cleans_related_tables() {
let db = db::create_test_pool().await;
let keyholder = KeyHolder::spawn(KeyHolder::new(db.clone()).await.unwrap());
let mut actor = EvmActor::new(keyholder, db.clone());
let mut conn = db.get().await.unwrap();
let basic_id: i32 = insert_into(schema::evm_basic_grant::table)
.values(&models::NewEvmBasicGrant {
wallet_access_id: 1,
chain_id: 1,
valid_from: None,
valid_until: None,
max_gas_fee_per_gas: None,
max_priority_fee_per_gas: None,
rate_limit_count: None,
rate_limit_window_secs: None,
revoked_at: None,
})
.returning(schema::evm_basic_grant::id)
.get_result(&mut conn)
.await
.unwrap();
let token_grant_id: i32 = insert_into(schema::evm_token_transfer_grant::table)
.values(&models::NewEvmTokenTransferGrant {
basic_grant_id: basic_id,
token_contract: vec![1u8; 20],
receiver: None,
})
.returning(schema::evm_token_transfer_grant::id)
.get_result(&mut conn)
.await
.unwrap();
insert_into(schema::evm_token_transfer_volume_limit::table)
.values(&models::NewEvmTokenTransferVolumeLimit {
grant_id: token_grant_id,
window_secs: 60,
max_volume: vec![1],
})
.execute(&mut conn)
.await
.unwrap();
insert_into(schema::evm_token_transfer_volume_limit::table)
.values(&models::NewEvmTokenTransferVolumeLimit {
grant_id: token_grant_id,
window_secs: 3600,
max_volume: vec![2],
})
.execute(&mut conn)
.await
.unwrap();
let tx_log_id: i32 = insert_into(schema::evm_transaction_log::table)
.values(&models::NewEvmTransactionLog {
grant_id: basic_id,
wallet_access_id: 1,
chain_id: 1,
eth_value: vec![0],
signed_at: models::SqliteTimestamp::now(),
})
.returning(schema::evm_transaction_log::id)
.get_result(&mut conn)
.await
.unwrap();
insert_into(schema::evm_token_transfer_log::table)
.values(&models::NewEvmTokenTransferLog {
grant_id: token_grant_id,
log_id: tx_log_id,
chain_id: 1,
token_contract: vec![1u8; 20],
recipient_address: vec![2u8; 20],
value: vec![3],
})
.execute(&mut conn)
.await
.unwrap();
insert_into(schema::integrity_envelope::table)
.values(&models::NewIntegrityEnvelope {
entity_kind: "TokenTransfer".to_owned(),
entity_id: basic_id.to_be_bytes().to_vec(),
payload_version: 1,
key_version: 1,
mac: vec![0u8; 32],
})
.execute(&mut conn)
.await
.unwrap();
drop(conn);
actor.useragent_delete_grant(basic_id).await.unwrap();
let mut conn = db.get().await.unwrap();
let basic_count: i64 = schema::evm_basic_grant::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(basic_count, 0);
let token_grant_count: i64 = schema::evm_token_transfer_grant::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(token_grant_count, 0);
let token_limits_count: i64 = schema::evm_token_transfer_volume_limit::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(token_limits_count, 0);
let token_logs_count: i64 = schema::evm_token_transfer_log::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(token_logs_count, 0);
let tx_logs_count: i64 = schema::evm_transaction_log::table
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(tx_logs_count, 0);
let envelope_count: i64 = schema::integrity_envelope::table
.filter(schema::integrity_envelope::entity_kind.eq("TokenTransfer"))
.count()
.get_result(&mut conn)
.await
.unwrap();
assert_eq!(envelope_count, 0);
}

232
server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs
View File

@@ -1,127 +1,105 @@
use crate::{ use std::ops::ControlFlow;
actors::flow_coordinator::ApprovalError,
peers::{ use kameo::{
client::ClientProfile, Actor, messages,
operator::{OperatorSession, session::BeginNewClientApproval}, prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
}, reply::ReplySender,
}; };
use kameo::{ use crate::actors::{
Actor, messages, client::ClientProfile,
prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef}, flow_coordinator::ApprovalError,
reply::ReplySender, user_agent::{UserAgentSession, session::BeginNewClientApproval},
}; };
use std::{ops::ControlFlow, time::Duration};
pub struct Args {
const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30); pub client: ClientProfile,
pub user_agents: Vec<ActorRef<UserAgentSession>>,
pub struct Args { pub reply: ReplySender<Result<bool, ApprovalError>>,
pub client: ClientProfile, }
pub operators: Vec<ActorRef<OperatorSession>>,
pub reply: ReplySender<Result<bool, ApprovalError>>, pub struct ClientApprovalController {
} /// Number of UAs that have not yet responded (approval or denial) or died.
pending: usize,
pub struct ClientApprovalController { /// Number of approvals received so far.
/// Number of operators that have not yet responded (approval or denial) or died. approved: usize,
pending: usize, reply: Option<ReplySender<Result<bool, ApprovalError>>>,
/// Number of approvals received so far. }
approved: usize,
reply: Option<ReplySender<Result<bool, ApprovalError>>>, impl ClientApprovalController {
} fn send_reply(&mut self, result: Result<bool, ApprovalError>) {
if let Some(reply) = self.reply.take() {
impl ClientApprovalController { reply.send(result);
fn send_reply(&mut self, result: Result<bool, ApprovalError>) { }
if let Some(reply) = self.reply.take() { }
reply.send(result); }
}
} impl Actor for ClientApprovalController {
} type Args = Args;
type Error = ();
impl Actor for ClientApprovalController {
type Args = Args; async fn on_start(
type Error = (); Args {
client,
async fn on_start( mut user_agents,
Args { reply,
client, }: Self::Args,
operators, actor_ref: ActorRef<Self>,
reply, ) -> Result<Self, Self::Error> {
}: Self::Args, let this = Self {
actor_ref: ActorRef<Self>, pending: user_agents.len(),
) -> Result<Self, Self::Error> { approved: 0,
let this = Self { reply: Some(reply),
pending: operators.len(), };
approved: 0,
reply: Some(reply), for user_agent in user_agents.drain(..) {
}; actor_ref.link(&user_agent).await;
let _ = user_agent
for operator in operators { .tell(BeginNewClientApproval {
actor_ref.link(&operator).await; client: client.clone(),
controller: actor_ref.clone(),
let _ = operator })
.tell(BeginNewClientApproval { .await;
client: client.clone(), }
controller: actor_ref.clone(),
}) Ok(this)
.await; }
}
async fn on_link_died(
let weak = actor_ref.downgrade(); &mut self,
tokio::spawn(async move { _: WeakActorRef<Self>,
tokio::time::sleep(APPROVAL_TIMEOUT).await; _: ActorId,
if let Some(r) = weak.upgrade() { _: ActorStopReason,
let _ = r.tell(OnApprovalTimeout {}).await; ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
} // A linked UA died before responding — counts as a non-approval.
}); self.pending = self.pending.saturating_sub(1);
if self.pending == 0 {
Ok(this) // At least one UA didn't approve: deny.
} self.send_reply(Ok(false));
return Ok(ControlFlow::Break(ActorStopReason::Normal));
async fn on_link_died( }
&mut self, Ok(ControlFlow::Continue(()))
_: WeakActorRef<Self>, }
_: ActorId, }
_: ActorStopReason,
) -> Result<ControlFlow<ActorStopReason>, Self::Error> { #[messages]
// A linked operator died before responding — counts as a non-approval. impl ClientApprovalController {
self.pending = self.pending.saturating_sub(1); #[message(ctx)]
if self.pending == 0 { pub async fn client_approval_answer(&mut self, approved: bool, ctx: &mut Context<Self, ()>) {
// At least one operator didn't approve: deny. if !approved {
self.send_reply(Ok(false)); // Denial wins immediately regardless of other pending responses.
return Ok(ControlFlow::Break(ActorStopReason::Normal)); self.send_reply(Ok(false));
} ctx.stop();
Ok(ControlFlow::Continue(())) return;
} }
}
self.approved += 1;
#[messages] self.pending = self.pending.saturating_sub(1);
impl ClientApprovalController {
#[message(ctx)] if self.pending == 0 {
pub fn client_approval_answer(&mut self, approved: bool, ctx: &mut Context<Self, ()>) { // Every connected UA approved.
if !approved { self.send_reply(Ok(true));
// Denial wins immediately regardless of other pending responses. ctx.stop();
self.send_reply(Ok(false)); }
ctx.stop(); }
return; }
}
self.approved += 1;
self.pending = self.pending.saturating_sub(1);
if self.pending == 0 {
// Every connected operator approved.
self.send_reply(Ok(true));
ctx.stop();
}
}
/// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded
/// by then is treated as a denial to prevent zombie sessions from blocking the flow.
#[message(ctx)]
pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) {
if self.pending > 0 {
self.send_reply(Ok(false));
ctx.stop();
}
}
}

232
server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
View File

@@ -1,114 +1,118 @@
use crate::{ use std::{collections::HashMap, ops::ControlFlow};
actors::{
flow_coordinator::client_connect_approval::ClientApprovalController, use kameo::{
operator_registry::{GetConnected, OperatorRegistry}, Actor,
}, actor::{ActorId, ActorRef, Spawn},
peers::client::{ClientProfile, session::ClientSession}, messages,
}; prelude::{ActorStopReason, Context, WeakActorRef},
reply::DelegatedReply,
use kameo::{ };
Actor, use tracing::info;
actor::{ActorId, ActorRef, Spawn},
messages, use crate::actors::{
prelude::{ActorStopReason, Context, WeakActorRef}, client::{ClientProfile, session::ClientSession},
reply::DelegatedReply, flow_coordinator::client_connect_approval::ClientApprovalController,
}; user_agent::session::UserAgentSession,
use std::{collections::HashMap, ops::ControlFlow}; };
use tracing::info;
pub mod client_connect_approval;
pub mod client_connect_approval;
#[derive(Default)]
pub struct FlowCoordinator { pub struct FlowCoordinator {
pub clients: HashMap<ActorId, ActorRef<ClientSession>>, pub user_agents: HashMap<ActorId, ActorRef<UserAgentSession>>,
operator_registry: ActorRef<OperatorRegistry>, pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
} }
impl FlowCoordinator { impl Actor for FlowCoordinator {
pub fn new(operator_registry: ActorRef<OperatorRegistry>) -> Self { type Args = Self;
Self {
clients: HashMap::default(), type Error = ();
operator_registry,
} async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
} Ok(args)
} }
impl Actor for FlowCoordinator { async fn on_link_died(
type Args = Self; &mut self,
_: WeakActorRef<Self>,
type Error = (); id: ActorId,
_: ActorStopReason,
async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> { ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
Ok(args) if self.user_agents.remove(&id).is_some() {
} info!(
?id,
async fn on_link_died( actor = "FlowCoordinator",
&mut self, event = "useragent.disconnected"
_: WeakActorRef<Self>, );
id: ActorId, } else if self.clients.remove(&id).is_some() {
_: ActorStopReason, info!(
) -> Result<ControlFlow<ActorStopReason>, Self::Error> { ?id,
if self.clients.remove(&id).is_some() { actor = "FlowCoordinator",
info!( event = "client.disconnected"
?id, );
actor = "FlowCoordinator", } else {
event = "client.disconnected" info!(
); ?id,
} else { actor = "FlowCoordinator",
info!( event = "unknown.actor.disconnected"
?id, );
actor = "FlowCoordinator", }
event = "unknown.actor.disconnected" Ok(ControlFlow::Continue(()))
); }
} }
Ok(ControlFlow::Continue(()))
} #[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)]
} pub enum ApprovalError {
#[error("No user agents connected")]
#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)] NoUserAgentsConnected,
pub enum ApprovalError { }
#[error("No operators connected")]
NoOperatorsConnected, #[messages]
} impl FlowCoordinator {
#[message(ctx)]
#[messages] pub async fn register_user_agent(
impl FlowCoordinator { &mut self,
#[message(ctx)] actor: ActorRef<UserAgentSession>,
pub async fn register_client( ctx: &mut Context<Self, ()>,
&mut self, ) {
actor: ActorRef<ClientSession>, info!(id = %actor.id(), actor = "FlowCoordinator", event = "useragent.connected");
ctx: &mut Context<Self, ()>, ctx.actor_ref().link(&actor).await;
) { self.user_agents.insert(actor.id(), actor);
info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected"); }
ctx.actor_ref().link(&actor).await;
self.clients.insert(actor.id(), actor); #[message(ctx)]
} pub async fn register_client(
&mut self,
#[message(ctx)] actor: ActorRef<ClientSession>,
pub async fn request_client_approval( ctx: &mut Context<Self, ()>,
&mut self, ) {
client: ClientProfile, info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>, ctx.actor_ref().link(&actor).await;
) -> DelegatedReply<Result<bool, ApprovalError>> { self.clients.insert(actor.id(), actor);
let (reply, Some(reply_sender)) = ctx.reply_sender() else { }
unreachable!("Expected `request_client_approval` to have callback channel");
}; #[message(ctx)]
pub async fn request_client_approval(
let Ok(refs) = self.operator_registry.ask(GetConnected).await else { &mut self,
reply_sender.send(Err(ApprovalError::NoOperatorsConnected)); client: ClientProfile,
return reply; ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>,
}; ) -> DelegatedReply<Result<bool, ApprovalError>> {
let (reply, Some(reply_sender)) = ctx.reply_sender() else {
if refs.is_empty() { unreachable!("Expected `request_client_approval` to have callback channel");
reply_sender.send(Err(ApprovalError::NoOperatorsConnected)); };
return reply;
} let refs: Vec<_> = self.user_agents.values().cloned().collect();
if refs.is_empty() {
ClientApprovalController::spawn(client_connect_approval::Args { reply_sender.send(Err(ApprovalError::NoUserAgentsConnected));
client, return reply;
operators: refs, }
reply: reply_sender,
}); ClientApprovalController::spawn(client_connect_approval::Args {
client,
reply user_agents: refs,
} reply: reply_sender,
} });
reply
}
}

923
server/crates/arbiter-server/src/actors/vault/mod.rs → server/crates/arbiter-server/src/actors/keyholder/mod.rs
View File

@@ -1,462 +1,461 @@
use crate::{ use chrono::Utc;
crypto::{ use diesel::{
KeyCell, derive_key, ExpressionMethods as _, OptionalExtension, QueryDsl, SelectableHelper,
encryption::v1::{self, Nonce}, dsl::{insert_into, update},
integrity::v1::HmacSha256, };
}, use diesel_async::{AsyncConnection, RunQueryDsl};
db::{ use hmac::Mac as _;
self, use kameo::{Actor, Reply, messages};
models::{self, RootKeyHistory}, use strum::{EnumDiscriminants, IntoDiscriminant};
schema::{self}, use tracing::{error, info};
},
}; use crate::{
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _}; crypto::{
KeyCell, derive_key,
use chrono::Utc; encryption::v1::{self, Nonce},
use diesel::{ integrity::v1::HmacSha256,
ExpressionMethods as _, OptionalExtension, QueryDsl, SelectableHelper, },
dsl::{insert_into, update}, safe_cell::SafeCell,
}; };
use diesel_async::{AsyncConnection, RunQueryDsl}; use crate::{
use hmac::{KeyInit as _, Mac as _}; db::{
use kameo::{Actor, Reply, actor::ActorRef, messages}; self,
use kameo_actors::message_bus::{MessageBus, Publish}; models::{self, RootKeyHistory},
use strum::{EnumDiscriminants, IntoDiscriminant}; schema::{self},
use tracing::{error, info}; },
safe_cell::SafeCellHandle as _,
pub mod events { };
#[derive(Clone, Copy)] #[derive(Default, EnumDiscriminants)]
pub struct Bootstrapped; #[strum_discriminants(derive(Reply), vis(pub), name(KeyHolderState))]
enum State {
#[derive(Clone, Copy)] #[default]
pub struct Unsealed; Unbootstrapped,
Sealed {
#[derive(Clone, Copy)] root_key_history_id: i32,
pub struct VaultResealed; },
} Unsealed {
root_key_history_id: i32,
#[derive(Debug, thiserror::Error)] root_key: KeyCell,
pub enum Error { },
#[error("Vault is already bootstrapped")] }
AlreadyBootstrapped,
#[error("Vault is not bootstrapped")] #[derive(Debug, thiserror::Error)]
NotBootstrapped, pub enum Error {
#[error("Vault is sealed")] #[error("Keyholder is already bootstrapped")]
Sealed, AlreadyBootstrapped,
#[error("Invalid key provided")] #[error("Keyholder is not bootstrapped")]
InvalidKey, NotBootstrapped,
#[error("Invalid key provided")]
#[error("Requested aead entry not found")] InvalidKey,
NotFound,
#[error("Requested aead entry not found")]
#[error("Encryption error: {0}")] NotFound,
Encryption(#[from] chacha20poly1305::aead::Error),
#[error("Encryption error: {0}")]
#[error("Database error: {0}")] Encryption(#[from] chacha20poly1305::aead::Error),
DatabaseConnection(#[from] db::PoolError),
#[error("Database error: {0}")]
#[error("Database transaction error: {0}")] DatabaseConnection(#[from] db::PoolError),
DatabaseTransaction(#[from] diesel::result::Error),
#[error("Database transaction error: {0}")]
#[error("Broken database")] DatabaseTransaction(#[from] diesel::result::Error),
BrokenDatabase,
} #[error("Broken database")]
BrokenDatabase,
struct Unsealed { }
root_key_history_id: i32,
root_key: KeyCell, /// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
} /// Provides API for encrypting and decrypting data using the vault root key.
/// Abstraction over database to make sure nonces are never reused and encryption keys are never exposed in plaintext outside of this actor.
#[derive(Default, EnumDiscriminants)] #[derive(Actor)]
#[strum_discriminants(derive(Reply), vis(pub), name(VaultState))] pub struct KeyHolder {
enum State { db: db::DatabasePool,
#[default] state: State,
Unbootstrapped, }
Sealed {
root_key_history_id: i32, #[messages]
}, impl KeyHolder {
Unsealed(Unsealed), pub async fn new(db: db::DatabasePool) -> Result<Self, Error> {
} let state = {
let mut conn = db.get().await?;
/// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
/// let (root_key_history,) = schema::arbiter_settings::table
/// Provides API for encrypting and decrypting data using the vault root key. .left_join(schema::root_key_history::table)
/// Abstraction over database to make sure nonces are never reused and encryption keys are never exposed in plaintext outside of this actor. .select((Option::<RootKeyHistory>::as_select(),))
#[derive(Actor)] .get_result::<(Option<RootKeyHistory>,)>(&mut conn)
pub struct Vault { .await?;
db: db::DatabasePool,
state: State, match root_key_history {
events: ActorRef<MessageBus>, Some(root_key_history) => State::Sealed {
} root_key_history_id: root_key_history.id,
},
#[messages] None => State::Unbootstrapped,
impl Vault { }
pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> { };
let state = {
let mut conn = db.get().await?; Ok(Self { db, state })
}
let (root_key_history,) = schema::arbiter_settings::table
.left_join(schema::root_key_history::table) // Exclusive transaction to avoid race condtions if multiple keyholders write
.select((Option::<RootKeyHistory>::as_select(),)) // additional layer of protection against nonce-reuse
.get_result::<(Option<RootKeyHistory>,)>(&mut conn) async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
.await?; let mut conn = pool.get().await?;
match root_key_history { let nonce = conn
Some(root_key_history) => State::Sealed { .exclusive_transaction(|conn| {
root_key_history_id: root_key_history.id, Box::pin(async move {
}, let current_nonce: Vec<u8> = schema::root_key_history::table
None => State::Unbootstrapped, .filter(schema::root_key_history::id.eq(root_key_id))
} .select(schema::root_key_history::data_encryption_nonce)
}; .first(conn)
.await?;
Ok(Self { db, state, events })
} let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|_| {
error!(
// Exclusive transaction to avoid race condtions if multiple vaults write "Broken database: invalid nonce for root key history id={}",
// additional layer of protection against nonce-reuse root_key_id
async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> { );
let mut conn = pool.get().await?; Error::BrokenDatabase
})?;
let nonce = conn nonce.increment();
.exclusive_transaction(async |conn| {
let current_nonce: Vec<u8> = schema::root_key_history::table update(schema::root_key_history::table)
.filter(schema::root_key_history::id.eq(root_key_id)) .filter(schema::root_key_history::id.eq(root_key_id))
.select(schema::root_key_history::data_encryption_nonce) .set(schema::root_key_history::data_encryption_nonce.eq(nonce.to_vec()))
.first(&mut *conn) .execute(conn)
.await?; .await?;
let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| { Result::<_, Error>::Ok(nonce)
error!( })
"Broken database: invalid nonce for root key history id={}", })
root_key_id .await?;
);
Error::BrokenDatabase Ok(nonce)
})?; }
nonce.increment();
#[message]
update(schema::root_key_history::table) pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
.filter(schema::root_key_history::id.eq(root_key_id)) if !matches!(self.state, State::Unbootstrapped) {
.set(schema::root_key_history::data_encryption_nonce.eq(nonce.to_vec())) return Err(Error::AlreadyBootstrapped);
.execute(&mut *conn) }
.await?; let salt = v1::generate_salt();
let mut seal_key = derive_key(seal_key_raw, &salt);
Result::<_, Error>::Ok(nonce) let mut root_key = KeyCell::new_secure_random();
})
.await?; // Zero nonces are fine because they are one-time
let root_key_nonce = Nonce::default();
Ok(nonce) let data_encryption_nonce = Nonce::default();
}
let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| {
const fn expect_unsealed(state: &mut State) -> Result<&mut Unsealed, Error> { let root_key_reader = reader.as_slice();
match state { seal_key
State::Unsealed(unsealed) => Ok(unsealed), .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
State::Unbootstrapped => Err(Error::NotBootstrapped), .map_err(|err| {
State::Sealed { .. } => Err(Error::Sealed), error!(?err, "Fatal bootstrap error");
} Error::Encryption(err)
} })
})?;
#[message]
pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> { let mut conn = self.db.get().await?;
if !matches!(self.state, State::Unbootstrapped) {
return Err(Error::AlreadyBootstrapped); let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
} let root_key_history_id = conn
let salt = v1::generate_salt(); .transaction(|conn| {
let mut seal_key = derive_key(seal_key_raw, &salt); Box::pin(async move {
let mut root_key = KeyCell::new_secure_random(); let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
.values(&models::NewRootKeyHistory {
// Zero nonces are fine because they are one-time ciphertext: root_key_ciphertext,
let root_key_nonce = Nonce::default(); tag: v1::ROOT_KEY_TAG.to_vec(),
let data_encryption_nonce = Nonce::default(); root_key_encryption_nonce: root_key_nonce.to_vec(),
data_encryption_nonce: data_encryption_nonce_bytes,
let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| { schema_version: 1,
let root_key_reader = reader.as_slice(); salt: salt.to_vec(),
seal_key })
.encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader) .returning(schema::root_key_history::id)
.map_err(|err| { .get_result(conn)
error!(?err, "Fatal bootstrap error"); .await?;
Error::Encryption(err)
}) update(schema::arbiter_settings::table)
})?; .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
.execute(conn)
let mut conn = self.db.get().await?; .await?;
let data_encryption_nonce_bytes = data_encryption_nonce.to_vec(); Result::<_, diesel::result::Error>::Ok(root_key_history_id)
let root_key_history_id = conn })
.transaction(async |conn| { })
let root_key_history_id: i32 = insert_into(schema::root_key_history::table) .await?;
.values(&models::NewRootKeyHistory {
ciphertext: root_key_ciphertext.clone(), self.state = State::Unsealed {
tag: v1::ROOT_KEY_TAG.to_vec(), root_key,
root_key_encryption_nonce: root_key_nonce.to_vec(), root_key_history_id,
data_encryption_nonce: data_encryption_nonce_bytes.clone(), };
schema_version: 1,
salt: salt.to_vec(), info!("Keyholder bootstrapped successfully");
})
.returning(schema::root_key_history::id) Ok(())
.get_result(&mut *conn) }
.await?;
#[message]
update(schema::arbiter_settings::table) pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
.set(schema::arbiter_settings::root_key_id.eq(root_key_history_id)) let State::Sealed {
.execute(&mut *conn) root_key_history_id,
.await?; } = &self.state
else {
Result::<_, diesel::result::Error>::Ok(root_key_history_id) return Err(Error::NotBootstrapped);
}) };
.await?;
// We don't want to hold connection while doing expensive KDF work
self.state = State::Unsealed(Unsealed { let current_key = {
root_key, let mut conn = self.db.get().await?;
root_key_history_id, schema::root_key_history::table
}); .filter(schema::root_key_history::id.eq(*root_key_history_id))
.select(RootKeyHistory::as_select())
info!("Vault bootstrapped successfully"); .first(&mut conn)
let _ = self.events.tell(Publish(events::Bootstrapped)).await; .await?
};
Ok(())
} let salt = &current_key.salt;
let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| {
#[message] error!("Broken database: invalid salt for root key");
pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> { Error::BrokenDatabase
let State::Sealed { })?;
root_key_history_id, let mut seal_key = derive_key(seal_key_raw, &salt);
} = &self.state
else { let mut root_key = SafeCell::new(current_key.ciphertext.clone());
return Err(Error::NotBootstrapped);
}; let nonce = v1::Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(
|_| {
// We don't want to hold connection while doing expensive KDF work error!("Broken database: invalid nonce for root key");
let current_key = { Error::BrokenDatabase
let mut conn = self.db.get().await?; },
schema::root_key_history::table )?;
.filter(schema::root_key_history::id.eq(*root_key_history_id))
.select(RootKeyHistory::as_select()) seal_key
.first(&mut conn) .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
.await? .map_err(|err| {
}; error!(?err, "Failed to unseal root key: invalid seal key");
Error::InvalidKey
let salt = &current_key.salt; })?;
let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| {
error!("Broken database: invalid salt for root key"); self.state = State::Unsealed {
Error::BrokenDatabase root_key_history_id: current_key.id,
})?; root_key: KeyCell::try_from(root_key).map_err(|err| {
let mut seal_key = derive_key(seal_key_raw, &salt); error!(?err, "Broken database: invalid encryption key size");
Error::BrokenDatabase
let mut root_key = SafeCell::new(current_key.ciphertext.clone()); })?,
};
let nonce =
Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| { info!("Keyholder unsealed successfully");
error!("Broken database: invalid nonce for root key");
Error::BrokenDatabase Ok(())
})?; }
seal_key #[message]
.decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key) pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
.map_err(|err| { let State::Unsealed { root_key, .. } = &mut self.state else {
error!(?err, "Failed to unseal root key: invalid seal key"); return Err(Error::NotBootstrapped);
Error::InvalidKey };
})?;
let row: models::AeadEncrypted = {
self.state = State::Unsealed(Unsealed { let mut conn = self.db.get().await?;
root_key_history_id: current_key.id, schema::aead_encrypted::table
root_key: KeyCell::try_from(root_key).map_err(|err| { .select(models::AeadEncrypted::as_select())
error!(?err, "Broken database: invalid encryption key size"); .filter(schema::aead_encrypted::id.eq(aead_id))
Error::BrokenDatabase .first(&mut conn)
})?, .await
}); .optional()?
.ok_or(Error::NotFound)?
info!("Vault unsealed successfully"); };
let _ = self.events.tell(Publish(events::Unsealed)).await;
let nonce = v1::Nonce::try_from(row.current_nonce.as_slice()).map_err(|_| {
Ok(()) error!(
} "Broken database: invalid nonce for aead_encrypted id={}",
aead_id
#[message] );
pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> { Error::BrokenDatabase
let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?; })?;
let mut output = SafeCell::new(row.ciphertext);
let row: models::AeadEncrypted = { root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
let mut conn = self.db.get().await?; Ok(output)
schema::aead_encrypted::table }
.select(models::AeadEncrypted::as_select())
.filter(schema::aead_encrypted::id.eq(aead_id)) // Creates new `aead_encrypted` entry in the database and returns it's ID
.first(&mut conn) #[message]
.await pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
.optional()? let State::Unsealed {
.ok_or(Error::NotFound)? root_key,
}; root_key_history_id,
..
let nonce = Nonce::try_from(row.current_nonce.as_slice()).map_err(|()| { } = &mut self.state
error!( else {
"Broken database: invalid nonce for aead_encrypted id={}", return Err(Error::NotBootstrapped);
aead_id };
);
Error::BrokenDatabase // Order matters here - `get_new_nonce` acquires connection, so we need to call it before next acquire
})?; // Borrow checker note: &mut borrow a few lines above is disjoint from this field
let mut output = SafeCell::new(row.ciphertext); let nonce = Self::get_new_nonce(&self.db, *root_key_history_id).await?;
root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
Ok(output) let mut ciphertext_buffer = plaintext.write();
} let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;
// Creates new `aead_encrypted` entry in the database and returns it's ID
#[message] let ciphertext = std::mem::take(ciphertext_buffer);
pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
let Unsealed { let mut conn = self.db.get().await?;
root_key, let aead_id: i32 = insert_into(schema::aead_encrypted::table)
root_key_history_id, .values(&models::NewAeadEncrypted {
} = Self::expect_unsealed(&mut self.state)?; ciphertext,
tag: v1::TAG.to_vec(),
// Order matters here - `get_new_nonce` acquires connection, so we need to call it before next acquire current_nonce: nonce.to_vec(),
// Borrow checker note: &mut borrow a few lines above is disjoint from this field schema_version: 1,
let nonce = Self::get_new_nonce(&self.db, *root_key_history_id).await?; associated_root_key_id: *root_key_history_id,
created_at: Utc::now().into(),
let mut ciphertext_buffer = plaintext.write(); })
let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut(); .returning(schema::aead_encrypted::id)
root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?; .get_result(&mut conn)
.await?;
let ciphertext = std::mem::take(ciphertext_buffer);
Ok(aead_id)
let mut conn = self.db.get().await?; }
let aead_id: i32 = insert_into(schema::aead_encrypted::table)
.values(&models::NewAeadEncrypted { #[message]
ciphertext, pub fn get_state(&self) -> KeyHolderState {
tag: v1::TAG.to_vec(), self.state.discriminant()
current_nonce: nonce.to_vec(), }
schema_version: 1,
associated_root_key_id: *root_key_history_id, #[message]
created_at: Utc::now().into(), pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> {
}) let State::Unsealed {
.returning(schema::aead_encrypted::id) root_key,
.get_result(&mut conn) root_key_history_id,
.await?; } = &mut self.state
else {
Ok(aead_id) return Err(Error::NotBootstrapped);
} };
#[message] let mut hmac = root_key
pub fn get_state(&self) -> VaultState { .0
self.state.discriminant() .read_inline(|k| match HmacSha256::new_from_slice(k) {
} Ok(v) => v,
Err(_) => unreachable!("HMAC accepts keys of any size"),
#[message] });
pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> { hmac.update(&root_key_history_id.to_be_bytes());
let Unsealed { hmac.update(&mac_input);
root_key,
root_key_history_id, let mac = hmac.finalize().into_bytes().to_vec();
} = Self::expect_unsealed(&mut self.state)?; Ok((*root_key_history_id, mac))
}
let mut hmac = root_key.0.read_inline(|k| {
HmacSha256::new_from_slice(k) #[message]
.unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size")) pub fn verify_integrity(
}); &mut self,
hmac.update(&root_key_history_id.to_be_bytes()); mac_input: Vec<u8>,
hmac.update(&mac_input); expected_mac: Vec<u8>,
key_version: i32,
let mac = hmac.finalize().into_bytes().to_vec(); ) -> Result<bool, Error> {
Ok((*root_key_history_id, mac)) let State::Unsealed {
} root_key,
root_key_history_id,
#[message] } = &mut self.state
pub fn verify_integrity( else {
&mut self, return Err(Error::NotBootstrapped);
mac_input: Vec<u8>, };
expected_mac: Vec<u8>,
key_version: i32, if *root_key_history_id != key_version {
) -> Result<bool, Error> { return Ok(false);
let Unsealed { }
root_key,
root_key_history_id, let mut hmac = root_key
} = Self::expect_unsealed(&mut self.state)?; .0
.read_inline(|k| match HmacSha256::new_from_slice(k) {
if *root_key_history_id != key_version { Ok(v) => v,
return Ok(false); Err(_) => unreachable!("HMAC accepts keys of any size"),
} });
hmac.update(&key_version.to_be_bytes());
let mut hmac = root_key.0.read_inline(|k| { hmac.update(&mac_input);
HmacSha256::new_from_slice(k)
.unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size")) Ok(hmac.verify_slice(&expected_mac).is_ok())
}); }
hmac.update(&key_version.to_be_bytes());
hmac.update(&mac_input); #[message]
pub fn seal(&mut self) -> Result<(), Error> {
Ok(hmac.verify_slice(&expected_mac).is_ok()) let State::Unsealed {
} root_key_history_id,
..
#[message] } = &self.state
pub async fn seal(&mut self) -> Result<(), Error> { else {
let Unsealed { return Err(Error::NotBootstrapped);
root_key_history_id, };
.. self.state = State::Sealed {
} = Self::expect_unsealed(&mut self.state)?; root_key_history_id: *root_key_history_id,
};
self.state = State::Sealed { Ok(())
root_key_history_id: *root_key_history_id, }
}; }
let _ = self.events.tell(Publish(events::VaultResealed)).await;
Ok(()) #[cfg(test)]
} mod tests {
} use diesel::SelectableHelper;
#[cfg(test)] use diesel_async::RunQueryDsl;
mod tests {
use crate::actors::GlobalActors; use crate::{
use arbiter_crypto::safecell::SafeCellHandle as _; db::{self},
safe_cell::SafeCell,
use super::*; };
async fn bootstrapped_actor(db: &db::DatabasePool) -> Vault { use super::*;
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
.await async fn bootstrapped_actor(db: &db::DatabasePool) -> KeyHolder {
.unwrap(); let mut actor = KeyHolder::new(db.clone()).await.unwrap();
let seal_key = SafeCell::new(b"test-seal-key".to_vec()); let seal_key = SafeCell::new(b"test-seal-key".to_vec());
actor.bootstrap(seal_key).await.unwrap(); actor.bootstrap(seal_key).await.unwrap();
actor actor
} }
#[tokio::test] #[tokio::test]
#[test_log::test] #[test_log::test]
async fn nonce_monotonic_even_when_nonce_allocation_interleaves() { async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
let db = db::create_test_pool().await; let db = db::create_test_pool().await;
let mut actor = bootstrapped_actor(&db).await; let mut actor = bootstrapped_actor(&db).await;
let root_key_history_id = match actor.state {
let State::Unsealed(Unsealed { State::Unsealed {
root_key_history_id, root_key_history_id,
.. ..
}) = actor.state } => root_key_history_id,
else { _ => panic!("expected unsealed state"),
panic!("expected unsealed state") };
};
let n1 = KeyHolder::get_new_nonce(&db, root_key_history_id)
let n1 = Vault::get_new_nonce(&db, root_key_history_id) .await
.await .unwrap();
.unwrap(); let n2 = KeyHolder::get_new_nonce(&db, root_key_history_id)
let n2 = Vault::get_new_nonce(&db, root_key_history_id) .await
.await .unwrap();
.unwrap(); assert!(n2.to_vec() > n1.to_vec(), "nonce must increase");
assert!(n2.to_vec() > n1.to_vec(), "nonce must increase");
let mut conn = db.get().await.unwrap();
let mut conn = db.get().await.unwrap(); let root_row: models::RootKeyHistory = schema::root_key_history::table
let root_row: RootKeyHistory = schema::root_key_history::table .select(models::RootKeyHistory::as_select())
.select(RootKeyHistory::as_select()) .first(&mut conn)
.first(&mut conn) .await
.await .unwrap();
.unwrap(); assert_eq!(root_row.data_encryption_nonce, n2.to_vec());
assert_eq!(root_row.data_encryption_nonce, n2.to_vec());
let id = actor
let id = actor .create_new(SafeCell::new(b"post-interleave".to_vec()))
.create_new(SafeCell::new(b"post-interleave".to_vec())) .await
.await .unwrap();
.unwrap(); let row: models::AeadEncrypted = schema::aead_encrypted::table
let row: models::AeadEncrypted = schema::aead_encrypted::table .filter(schema::aead_encrypted::id.eq(id))
.filter(schema::aead_encrypted::id.eq(id)) .select(models::AeadEncrypted::as_select())
.select(models::AeadEncrypted::as_select()) .first(&mut conn)
.first(&mut conn) .await
.await .unwrap();
.unwrap(); assert!(
assert!( row.current_nonce > n2.to_vec(),
row.current_nonce > n2.to_vec(), "next write must advance nonce"
"next write must advance nonce" );
); }
} }
}

106
server/crates/arbiter-server/src/actors/mod.rs
View File

@@ -1,59 +1,47 @@
use crate::{ use kameo::actor::{ActorRef, Spawn};
actors::{ use thiserror::Error;
bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
operator_registry::OperatorRegistry, vault::Vault, use crate::{
}, actors::{
db, bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
}; keyholder::KeyHolder,
},
use kameo::actor::{ActorRef, Spawn}; db,
use kameo_actors::{DeliveryStrategy, message_bus::MessageBus}; };
use thiserror::Error;
pub mod bootstrap;
pub mod bootstrap; pub mod client;
pub mod evm; mod evm;
pub mod flow_coordinator; pub mod flow_coordinator;
pub mod operator_registry; pub mod keyholder;
pub mod vault; pub mod user_agent;
#[derive(Error, Debug)] #[derive(Error, Debug)]
pub enum SpawnError { pub enum SpawnError {
#[error("Failed to spawn Bootstrapper actor")] #[error("Failed to spawn Bootstrapper actor")]
Bootstrapper(#[from] bootstrap::Error), Bootstrapper(#[from] bootstrap::Error),
#[error("Failed to spawn Vault actor")] #[error("Failed to spawn KeyHolder actor")]
Vault(#[from] vault::Error), KeyHolder(#[from] keyholder::Error),
} }
/// Long-lived actors that are shared across all connections and handle global state and operations /// Long-lived actors that are shared across all connections and handle global state and operations
#[derive(Clone)] #[derive(Clone)]
pub struct GlobalActors { pub struct GlobalActors {
pub vault: ActorRef<Vault>, pub key_holder: ActorRef<KeyHolder>,
pub bootstrapper: ActorRef<Bootstrapper>, pub bootstrapper: ActorRef<Bootstrapper>,
pub flow_coordinator: ActorRef<FlowCoordinator>, pub flow_coordinator: ActorRef<FlowCoordinator>,
pub operator_registry: ActorRef<OperatorRegistry>, pub evm: ActorRef<EvmActor>,
pub evm: ActorRef<EvmActor>, }
pub events: ActorRef<MessageBus>,
} impl GlobalActors {
pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> {
impl GlobalActors { let key_holder = KeyHolder::spawn(KeyHolder::new(db.clone()).await?);
pub fn spawn_message_bus() -> ActorRef<MessageBus> { Ok(Self {
MessageBus::spawn(MessageBus::new(DeliveryStrategy::Guaranteed)) bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
} evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
key_holder,
pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> { flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::default()),
let message_bus = Self::spawn_message_bus(); })
let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?); }
let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default()); }
Ok(Self {
bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
vault: key_holder,
flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::new(
operator_registry.clone(),
)),
operator_registry,
events: message_bus,
})
}
}

61
server/crates/arbiter-server/src/actors/operator_registry.rs
View File

@@ -1,61 +0,0 @@
use crate::peers::operator::OperatorSession;
use kameo::{
Actor,
actor::{ActorId, ActorRef},
error::Infallible,
messages,
prelude::{ActorStopReason, Context, WeakActorRef},
};
use std::{collections::HashMap, ops::ControlFlow};
use tracing::info;
#[derive(Default)]
pub struct OperatorRegistry {
connected: HashMap<ActorId, ActorRef<OperatorSession>>,
}
impl Actor for OperatorRegistry {
type Args = Self;
type Error = Infallible;
async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
Ok(args)
}
async fn on_link_died(
&mut self,
_: WeakActorRef<Self>,
id: ActorId,
_: ActorStopReason,
) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
if self.connected.remove(&id).is_some() {
info!(
?id,
actor = "OperatorRegistry",
event = "operator.disconnected"
);
}
Ok(ControlFlow::Continue(()))
}
}
#[messages]
impl OperatorRegistry {
#[message(ctx)]
pub async fn connect_operator(
&mut self,
actor: ActorRef<OperatorSession>,
ctx: &mut Context<Self, ()>,
) {
info!(id = %actor.id(), actor = "OperatorRegistry", event = "operator.connected");
ctx.actor_ref().link(&actor).await;
self.connected.insert(actor.id(), actor);
}
#[message]
pub fn get_connected(&self) -> Vec<ActorRef<OperatorSession>> {
self.connected.values().cloned().collect()
}
}

215
server/crates/arbiter-server/src/peers/operator/auth/mod.rs → server/crates/arbiter-server/src/actors/user_agent/auth.rs
View File

@@ -1,107 +1,108 @@
use super::{Credentials, OperatorConnection}; use arbiter_proto::transport::Bi;
use arbiter_crypto::authn::{self, AuthChallenge}; use tracing::error;
use arbiter_proto::transport::Bi;
use crate::actors::user_agent::{
use state::{ AuthPublicKey, UserAgentConnection,
AuthContext, AuthError, AuthEvents, AuthStateMachine, AuthStates, ChallengeRequest, auth::state::{AuthContext, AuthStateMachine},
ChallengeSolution, };
};
use tracing::error; mod state;
use state::*;
mod state;
#[derive(Debug, Clone)]
#[derive(Debug, Clone)] pub enum Inbound {
pub enum Inbound { AuthChallengeRequest {
AuthChallengeRequest { pubkey: AuthPublicKey,
pubkey: authn::PublicKey, bootstrap_token: Option<String>,
bootstrap_token: Option<String>, },
}, AuthChallengeSolution {
AuthChallengeSolution { signature: Vec<u8>,
signature: Vec<u8>, },
}, }
}
#[derive(Debug)]
#[derive(Debug)] pub enum Error {
pub enum Error { UnregisteredPublicKey,
UnregisteredPublicKey, InvalidChallengeSolution,
InvalidChallengeSolution, InvalidBootstrapToken,
InvalidBootstrapToken, Internal { details: String },
Internal { details: String }, Transport,
Transport, }
}
impl Error {
impl Error { fn internal(details: impl Into<String>) -> Self {
fn internal(details: impl Into<String>) -> Self { Self::Internal {
Self::Internal { details: details.into(),
details: details.into(), }
} }
} }
}
impl From<diesel::result::Error> for Error {
impl From<diesel::result::Error> for Error { fn from(e: diesel::result::Error) -> Self {
fn from(e: diesel::result::Error) -> Self { error!(?e, "Database error");
error!(?e, "Database error"); Self::internal("Database error")
Self::internal("Database error") }
} }
}
#[derive(Debug, Clone)]
#[derive(Debug, Clone)] pub enum Outbound {
pub enum Outbound { AuthChallenge { nonce: i32 },
AuthChallenge { challenge: AuthChallenge }, AuthSuccess,
AuthSuccess, }
}
fn parse_auth_event(payload: Inbound) -> AuthEvents {
fn parse_auth_event(payload: Inbound) -> AuthEvents { match payload {
match payload { Inbound::AuthChallengeRequest {
Inbound::AuthChallengeRequest { pubkey,
pubkey, bootstrap_token: None,
bootstrap_token, } => AuthEvents::AuthRequest(ChallengeRequest { pubkey }),
} => AuthEvents::AuthRequest(ChallengeRequest { Inbound::AuthChallengeRequest {
pubkey, pubkey,
bootstrap_token, bootstrap_token: Some(token),
}), } => AuthEvents::BootstrapAuthRequest(BootstrapAuthRequest { pubkey, token }),
Inbound::AuthChallengeSolution { signature } => { Inbound::AuthChallengeSolution { signature } => {
AuthEvents::ReceivedSolution(ChallengeSolution { AuthEvents::ReceivedSolution(ChallengeSolution {
solution: signature, solution: signature,
}) })
} }
} }
} }
pub async fn authenticate<T>( pub async fn authenticate<T>(
props: &mut OperatorConnection, props: &mut UserAgentConnection,
transport: &mut T, transport: T,
) -> Result<Credentials, Error> ) -> Result<AuthPublicKey, Error>
where where
T: Bi<Inbound, Result<Outbound, Error>> + Send + ?Sized, T: Bi<Inbound, Result<Outbound, Error>> + Send,
{ {
let mut state = AuthStateMachine::new(AuthContext::new(props, transport)); let mut state = AuthStateMachine::new(AuthContext::new(props, transport));
loop { loop {
let Some(payload) = state.context_mut().transport.recv().await else { // `state` holds a mutable reference to `props` so we can't access it directly here
return Err(Error::Transport); let Some(payload) = state.context_mut().transport.recv().await else {
}; return Err(Error::Transport);
};
match state.process_event(parse_auth_event(payload)).await {
Ok(AuthStates::AuthOk(result)) => return Ok(result.clone()), match state.process_event(parse_auth_event(payload)).await {
Err(AuthError::ActionFailed(err)) => { Ok(AuthStates::AuthOk(key)) => return Ok(key.clone()),
error!(?err, "State machine action failed"); Err(AuthError::ActionFailed(err)) => {
return Err(err); error!(?err, "State machine action failed");
} return Err(err);
Err(AuthError::GuardFailed(err)) => { }
error!(?err, "State machine guard failed"); Err(AuthError::GuardFailed(err)) => {
return Err(err); error!(?err, "State machine guard failed");
} return Err(err);
Err(AuthError::InvalidEvent) => { }
error!("Invalid event for current state"); Err(AuthError::InvalidEvent) => {
return Err(Error::InvalidChallengeSolution); error!("Invalid event for current state");
} return Err(Error::InvalidChallengeSolution);
Err(AuthError::TransitionsFailed) => { }
error!("Invalid state transition"); Err(AuthError::TransitionsFailed) => {
return Err(Error::InvalidChallengeSolution); error!("Invalid state transition");
} return Err(Error::InvalidChallengeSolution);
}
_ => (),
} _ => (),
} }
} }
}

344
server/crates/arbiter-server/src/actors/user_agent/auth/state.rs Normal file
View File

@@ -0,0 +1,344 @@
use arbiter_proto::transport::Bi;
use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl, update};
use diesel_async::{AsyncConnection, RunQueryDsl};
use kameo::{actor::ActorRef, error::SendError};
use tracing::error;
use super::Error;
use crate::{
actors::{
bootstrap::ConsumeToken,
keyholder::KeyHolder,
user_agent::{AuthPublicKey, UserAgentConnection, UserAgentCredentials, auth::Outbound},
},
crypto::integrity::{self, AttestationStatus},
db::{DatabasePool, schema::useragent_client},
};
pub struct ChallengeRequest {
pub pubkey: AuthPublicKey,
}
pub struct BootstrapAuthRequest {
pub pubkey: AuthPublicKey,
pub token: String,
}
pub struct ChallengeContext {
pub challenge_nonce: i32,
pub key: AuthPublicKey,
}
pub struct ChallengeSolution {
pub solution: Vec<u8>,
}
smlang::statemachine!(
name: Auth,
custom_error: true,
transitions: {
*Init + AuthRequest(ChallengeRequest) / async prepare_challenge = SentChallenge(ChallengeContext),
Init + BootstrapAuthRequest(BootstrapAuthRequest) / async verify_bootstrap_token = AuthOk(AuthPublicKey),
SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(AuthPublicKey),
}
);
/// Returns the current nonce, ready to use for the challenge nonce.
async fn get_current_nonce_and_id(
db: &DatabasePool,
key: &AuthPublicKey,
) -> Result<(i32, i32), Error> {
let mut db_conn = db.get().await.map_err(|e| {
error!(error = ?e, "Database pool error");
Error::internal("Database unavailable")
})?;
db_conn
.exclusive_transaction(|conn| {
Box::pin(async move {
useragent_client::table
.filter(useragent_client::public_key.eq(key.to_stored_bytes()))
.filter(useragent_client::key_type.eq(key.key_type()))
.select((useragent_client::id, useragent_client::nonce))
.first::<(i32, i32)>(conn)
.await
})
})
.await
.optional()
.map_err(|e| {
error!(error = ?e, "Database error");
Error::internal("Database operation failed")
})?
.ok_or_else(|| {
error!(?key, "Public key not found in database");
Error::UnregisteredPublicKey
})
}
async fn verify_integrity(
db: &DatabasePool,
keyholder: &ActorRef<KeyHolder>,
pubkey: &AuthPublicKey,
) -> Result<(), Error> {
let mut db_conn = db.get().await.map_err(|e| {
error!(error = ?e, "Database pool error");
Error::internal("Database unavailable")
})?;
let (id, nonce) = get_current_nonce_and_id(db, pubkey).await?;
let result = integrity::verify_entity(
&mut db_conn,
keyholder,
&UserAgentCredentials {
pubkey: pubkey.clone(),
nonce,
},
id,
)
.await
.map_err(|e| {
error!(?e, "Integrity verification failed");
Error::internal("Integrity verification failed")
})?;
Ok(())
}
async fn create_nonce(
db: &DatabasePool,
keyholder: &ActorRef<KeyHolder>,
pubkey: &AuthPublicKey,
) -> Result<i32, Error> {
let mut db_conn = db.get().await.map_err(|e| {
error!(error = ?e, "Database pool error");
Error::internal("Database unavailable")
})?;
let new_nonce = db_conn
.exclusive_transaction(|conn| {
Box::pin(async move {
let (id, new_nonce): (i32, i32) = update(useragent_client::table)
.filter(useragent_client::public_key.eq(pubkey.to_stored_bytes()))
.filter(useragent_client::key_type.eq(pubkey.key_type()))
.set(useragent_client::nonce.eq(useragent_client::nonce + 1))
.returning((useragent_client::id, useragent_client::nonce))
.get_result(conn)
.await
.map_err(|e| {
error!(error = ?e, "Database error");
Error::internal("Database operation failed")
})?;
integrity::sign_entity(
conn,
keyholder,
&UserAgentCredentials {
pubkey: pubkey.clone(),
nonce: new_nonce,
},
id,
)
.await
.map_err(|e| {
error!(?e, "Integrity signature update failed");
Error::internal("Database error")
})?;
Result::<_, Error>::Ok(new_nonce)
})
})
.await?;
Ok(new_nonce)
}
async fn register_key(
db: &DatabasePool,
keyholder: &ActorRef<KeyHolder>,
pubkey: &AuthPublicKey,
) -> Result<(), Error> {
let pubkey_bytes = pubkey.to_stored_bytes();
let key_type = pubkey.key_type();
let mut conn = db.get().await.map_err(|e| {
error!(error = ?e, "Database pool error");
Error::internal("Database unavailable")
})?;
conn.transaction(|conn| {
Box::pin(async move {
const NONCE_START: i32 = 1;
let id: i32 = diesel::insert_into(useragent_client::table)
.values((
useragent_client::public_key.eq(pubkey_bytes),
useragent_client::nonce.eq(NONCE_START),
useragent_client::key_type.eq(key_type),
))
.returning(useragent_client::id)
.get_result(conn)
.await
.map_err(|e| {
error!(error = ?e, "Database error");
Error::internal("Database operation failed")
})?;
let entity = UserAgentCredentials {
pubkey: pubkey.clone(),
nonce: NONCE_START,
};
integrity::sign_entity(conn, &keyholder, &entity, id)
.await
.map_err(|e| {
error!(error = ?e, "Failed to sign integrity tag for new user-agent key");
Error::internal("Failed to register public key")
})?;
Result::<_, Error>::Ok(())
})
})
.await?;
Ok(())
}
pub struct AuthContext<'a, T> {
pub(super) conn: &'a mut UserAgentConnection,
pub(super) transport: T,
}
impl<'a, T> AuthContext<'a, T> {
pub fn new(conn: &'a mut UserAgentConnection, transport: T) -> Self {
Self { conn, transport }
}
}
impl<T> AuthStateMachineContext for AuthContext<'_, T>
where
T: Bi<super::Inbound, Result<super::Outbound, Error>> + Send,
{
type Error = Error;
async fn prepare_challenge(
&mut self,
ChallengeRequest { pubkey }: ChallengeRequest,
) -> Result<ChallengeContext, Self::Error> {
verify_integrity(&self.conn.db, &self.conn.actors.key_holder, &pubkey).await?;
let nonce = create_nonce(&self.conn.db, &self.conn.actors.key_holder, &pubkey).await?;
self.transport
.send(Ok(Outbound::AuthChallenge { nonce }))
.await
.map_err(|e| {
error!(?e, "Failed to send auth challenge");
Error::Transport
})?;
Ok(ChallengeContext {
challenge_nonce: nonce,
key: pubkey,
})
}
#[allow(missing_docs)]
#[allow(clippy::result_unit_err)]
async fn verify_bootstrap_token(
&mut self,
BootstrapAuthRequest { pubkey, token }: BootstrapAuthRequest,
) -> Result<AuthPublicKey, Self::Error> {
let token_ok: bool = self
.conn
.actors
.bootstrapper
.ask(ConsumeToken {
token: token.clone(),
})
.await
.map_err(|e| {
error!(?e, "Failed to consume bootstrap token");
Error::internal("Failed to consume bootstrap token")
})?;
if !token_ok {
error!("Invalid bootstrap token provided");
return Err(Error::InvalidBootstrapToken);
}
match token_ok {
true => {
register_key(&self.conn.db, &self.conn.actors.key_holder, &pubkey).await?;
self.transport
.send(Ok(Outbound::AuthSuccess))
.await
.map_err(|_| Error::Transport)?;
Ok(pubkey)
}
false => {
error!("Invalid bootstrap token provided");
self.transport
.send(Err(Error::InvalidBootstrapToken))
.await
.map_err(|_| Error::Transport)?;
Err(Error::InvalidBootstrapToken)
}
}
}
#[allow(missing_docs)]
#[allow(clippy::unused_unit)]
async fn verify_solution(
&mut self,
ChallengeContext {
challenge_nonce,
key,
}: &ChallengeContext,
ChallengeSolution { solution }: ChallengeSolution,
) -> Result<AuthPublicKey, Self::Error> {
let formatted = arbiter_proto::format_challenge(*challenge_nonce, &key.to_stored_bytes());
let valid = match key {
AuthPublicKey::Ed25519(vk) => {
let sig = solution.as_slice().try_into().map_err(|_| {
error!(?solution, "Invalid Ed25519 signature length");
Error::InvalidChallengeSolution
})?;
vk.verify_strict(&formatted, &sig).is_ok()
}
AuthPublicKey::EcdsaSecp256k1(vk) => {
use k256::ecdsa::signature::Verifier as _;
let sig = k256::ecdsa::Signature::try_from(solution.as_slice()).map_err(|_| {
error!(?solution, "Invalid ECDSA signature bytes");
Error::InvalidChallengeSolution
})?;
vk.verify(&formatted, &sig).is_ok()
}
AuthPublicKey::Rsa(pk) => {
use rsa::signature::Verifier as _;
let verifying_key = rsa::pss::VerifyingKey::<sha2::Sha256>::new(pk.clone());
let sig = rsa::pss::Signature::try_from(solution.as_slice()).map_err(|_| {
error!(?solution, "Invalid RSA signature bytes");
Error::InvalidChallengeSolution
})?;
verifying_key.verify(&formatted, &sig).is_ok()
}
};
match valid {
true => {
self.transport
.send(Ok(Outbound::AuthSuccess))
.await
.map_err(|_| Error::Transport)?;
Ok(key.clone())
}
false => {
self.transport
.send(Err(Error::InvalidChallengeSolution))
.await
.map_err(|_| Error::Transport)?;
Err(Error::InvalidChallengeSolution)
}
}
}
}

142
server/crates/arbiter-server/src/actors/user_agent/mod.rs Normal file
View File

@@ -0,0 +1,142 @@
use crate::{
actors::{GlobalActors, client::ClientProfile}, crypto::integrity::Integrable, db::{self, models::KeyType}
};
fn serialize_ecdsa<S>(key: &k256::ecdsa::VerifyingKey, serializer: S) -> Result<S::Ok, S::Error>
where
S: serde::Serializer,
{
// Serialize as hex string for easier debugging (33 bytes compressed SEC1 format)
let key = key.to_encoded_point(true);
let bytes = key.as_bytes();
serializer.serialize_bytes(bytes)
}
fn deserialize_ecdsa<'de, D>(deserializer: D) -> Result<k256::ecdsa::VerifyingKey, D::Error>
where
D: serde::Deserializer<'de>,
{
struct EcdsaVisitor;
impl<'de> serde::de::Visitor<'de> for EcdsaVisitor {
type Value = k256::ecdsa::VerifyingKey;
fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
formatter.write_str("a compressed SEC1-encoded ECDSA public key")
}
fn visit_bytes<E>(self, v: &[u8]) -> Result<Self::Value, E>
where
E: serde::de::Error,
{
let point = k256::EncodedPoint::from_bytes(v)
.map_err(|_| E::custom("invalid compressed SEC1 format"))?;
k256::ecdsa::VerifyingKey::from_encoded_point(&point)
.map_err(|_| E::custom("invalid ECDSA public key"))
}
}
deserializer.deserialize_bytes(EcdsaVisitor)
}
/// Abstraction over Ed25519 / ECDSA-secp256k1 / RSA public keys used during the auth handshake.
#[derive(Clone, Debug, Serialize)]
pub enum AuthPublicKey {
Ed25519(ed25519_dalek::VerifyingKey),
/// Compressed SEC1 public key; signature bytes are raw 64-byte (r||s).
#[serde(serialize_with = "serialize_ecdsa", deserialize_with = "deserialize_ecdsa")]
EcdsaSecp256k1(k256::ecdsa::VerifyingKey),
/// RSA-2048+ public key (Windows Hello / KeyCredentialManager); signature bytes are PSS+SHA-256.
Rsa(rsa::RsaPublicKey),
}
#[derive(Debug, Serialize)]
pub struct UserAgentCredentials {
pub pubkey: AuthPublicKey,
pub nonce: i32
}
impl Integrable for UserAgentCredentials {
const KIND: &'static str = "useragent_credentials";
}
impl AuthPublicKey {
/// Canonical bytes stored in DB and echoed back in the challenge.
/// Ed25519: raw 32 bytes. ECDSA: SEC1 compressed 33 bytes. RSA: DER-encoded SPKI.
pub fn to_stored_bytes(&self) -> Vec<u8> {
match self {
AuthPublicKey::Ed25519(k) => k.to_bytes().to_vec(),
// SEC1 compressed (33 bytes) is the natural compact format for secp256k1
AuthPublicKey::EcdsaSecp256k1(k) => k.to_encoded_point(true).as_bytes().to_vec(),
AuthPublicKey::Rsa(k) => {
use rsa::pkcs8::EncodePublicKey as _;
#[allow(clippy::expect_used)]
k.to_public_key_der()
.expect("rsa SPKI encoding is infallible")
.to_vec()
}
}
}
pub fn key_type(&self) -> KeyType {
match self {
AuthPublicKey::Ed25519(_) => KeyType::Ed25519,
AuthPublicKey::EcdsaSecp256k1(_) => KeyType::EcdsaSecp256k1,
AuthPublicKey::Rsa(_) => KeyType::Rsa,
}
}
}
impl TryFrom<(KeyType, Vec<u8>)> for AuthPublicKey {
type Error = &'static str;
fn try_from(value: (KeyType, Vec<u8>)) -> Result<Self, Self::Error> {
let (key_type, bytes) = value;
match key_type {
KeyType::Ed25519 => {
let bytes: [u8; 32] = bytes.try_into().map_err(|_| "invalid Ed25519 key length")?;
let key = ed25519_dalek::VerifyingKey::from_bytes(&bytes)
.map_err(|_e| "invalid Ed25519 key")?;
Ok(AuthPublicKey::Ed25519(key))
}
KeyType::EcdsaSecp256k1 => {
let point =
k256::EncodedPoint::from_bytes(&bytes).map_err(|_e| "invalid ECDSA key")?;
let key = k256::ecdsa::VerifyingKey::from_encoded_point(&point)
.map_err(|_e| "invalid ECDSA key")?;
Ok(AuthPublicKey::EcdsaSecp256k1(key))
}
KeyType::Rsa => {
use rsa::pkcs8::DecodePublicKey as _;
let key = rsa::RsaPublicKey::from_public_key_der(&bytes)
.map_err(|_e| "invalid RSA key")?;
Ok(AuthPublicKey::Rsa(key))
}
}
}
}
// Messages, sent by user agent to connection client without having a request
#[derive(Debug)]
pub enum OutOfBand {
ClientConnectionRequest { profile: ClientProfile },
ClientConnectionCancel { pubkey: ed25519_dalek::VerifyingKey },
}
pub struct UserAgentConnection {
pub(crate) db: db::DatabasePool,
pub(crate) actors: GlobalActors,
}
impl UserAgentConnection {
pub fn new(db: db::DatabasePool, actors: GlobalActors) -> Self {
Self { db, actors }
}
}
pub mod auth;
pub mod session;
pub use auth::authenticate;
use serde::Serialize;
pub use session::UserAgentSession;

342
server/crates/arbiter-server/src/peers/operator/session/mod.rs → server/crates/arbiter-server/src/actors/user_agent/session.rs
View File

@@ -1,161 +1,181 @@
use super::{OutOfBand, OperatorConnection}; use std::{borrow::Cow, collections::HashMap};
use crate::{
actors::{ use arbiter_proto::transport::Sender;
flow_coordinator::client_connect_approval::{ClientApprovalAnswer, ClientApprovalController}, use async_trait::async_trait;
operator_registry::ConnectOperator, use ed25519_dalek::VerifyingKey;
}, use kameo::{Actor, actor::ActorRef, messages};
peers::client::ClientProfile, use thiserror::Error;
}; use tracing::error;
use arbiter_crypto::authn;
use arbiter_proto::transport::Sender; use crate::actors::{
client::ClientProfile,
use kameo::{Actor, actor::ActorRef, messages}; flow_coordinator::{RegisterUserAgent, client_connect_approval::ClientApprovalController},
use std::{borrow::Cow, collections::HashMap}; user_agent::{OutOfBand, UserAgentConnection},
use thiserror::Error; };
use tracing::error;
mod state;
#[derive(Debug, Error)] use state::{DummyContext, UserAgentEvents, UserAgentStateMachine};
pub enum Error {
#[error("State transition failed")] #[derive(Debug, Error)]
State, pub enum Error {
#[error("State transition failed")]
#[error("Internal error: {message}")] State,
Internal { message: Cow<'static, str> },
} #[error("Internal error: {message}")]
Internal { message: Cow<'static, str> },
impl From<crate::db::PoolError> for Error { }
fn from(err: crate::db::PoolError) -> Self {
error!(?err, "Database pool error"); impl From<crate::db::PoolError> for Error {
Self::internal("Database pool error") fn from(err: crate::db::PoolError) -> Self {
} error!(?err, "Database pool error");
} Self::internal("Database pool error")
impl From<diesel::result::Error> for Error { }
fn from(err: diesel::result::Error) -> Self { }
error!(?err, "Database error"); impl From<diesel::result::Error> for Error {
Self::internal("Database error") fn from(err: diesel::result::Error) -> Self {
} error!(?err, "Database error");
} Self::internal("Database error")
}
impl Error { }
pub fn internal(message: impl Into<Cow<'static, str>>) -> Self {
Self::Internal { impl Error {
message: message.into(), pub fn internal(message: impl Into<Cow<'static, str>>) -> Self {
} Self::Internal {
} message: message.into(),
} }
}
pub struct PendingClientApproval { }
pubkey: authn::PublicKey,
controller: ActorRef<ClientApprovalController>, pub struct PendingClientApproval {
} controller: ActorRef<ClientApprovalController>,
}
pub struct OperatorSession {
props: OperatorConnection, pub struct UserAgentSession {
sender: Box<dyn Sender<OutOfBand>>, props: UserAgentConnection,
state: UserAgentStateMachine<DummyContext>,
pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>, sender: Box<dyn Sender<OutOfBand>>,
}
pending_client_approvals: HashMap<VerifyingKey, PendingClientApproval>,
pub mod handlers; }
impl OperatorSession { pub mod connection;
pub(crate) fn new(props: OperatorConnection, sender: Box<dyn Sender<OutOfBand>>) -> Self {
Self { impl UserAgentSession {
props, pub(crate) fn new(props: UserAgentConnection, sender: Box<dyn Sender<OutOfBand>>) -> Self {
sender, Self {
pending_client_approvals: HashMap::default(), props,
} state: UserAgentStateMachine::new(DummyContext),
} sender,
} pending_client_approvals: Default::default(),
}
#[messages] }
impl OperatorSession {
#[message] pub fn new_test(db: crate::db::DatabasePool, actors: crate::actors::GlobalActors) -> Self {
pub async fn begin_new_client_approval( struct DummySender;
&mut self,
client: ClientProfile, #[async_trait]
controller: ActorRef<ClientApprovalController>, impl Sender<OutOfBand> for DummySender {
) { async fn send(
if let Err(e) = self &mut self,
.sender _item: OutOfBand,
.send(OutOfBand::ClientConnectionRequest { ) -> Result<(), arbiter_proto::transport::Error> {
profile: client.clone(), Ok(())
}) }
.await }
{
error!( Self::new(UserAgentConnection::new(db, actors), Box::new(DummySender))
?e, }
actor = "operator",
event = "failed to announce new client connection" fn transition(&mut self, event: UserAgentEvents) -> Result<(), Error> {
); self.state.process_event(event).map_err(|e| {
let _ = controller.tell(ClientApprovalAnswer { approved: false }).await; error!(?e, "State transition failed");
return; Error::State
} })?;
Ok(())
self.pending_client_approvals.insert( }
client.pubkey.to_bytes(), }
PendingClientApproval {
pubkey: client.pubkey, #[messages]
controller, impl UserAgentSession {
}, #[message]
); pub async fn begin_new_client_approval(
} &mut self,
} client: ClientProfile,
controller: ActorRef<ClientApprovalController>,
impl Actor for OperatorSession { ) {
type Args = Self; if let Err(e) = self
.sender
type Error = Error; .send(OutOfBand::ClientConnectionRequest {
profile: client.clone(),
async fn on_start(args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> { })
args.props .await
.actors {
.operator_registry error!(
.ask(ConnectOperator { ?e,
actor: this.clone(), actor = "user_agent",
}) event = "failed to announce new client connection"
.await );
.map_err(|err| { return;
error!( }
?err,
"Failed to register operator connection with operator registry" self.pending_client_approvals
); .insert(client.pubkey, PendingClientApproval { controller });
Error::internal("Failed to register operator connection with operator registry") }
})?; }
Ok(args)
} impl Actor for UserAgentSession {
type Args = Self;
async fn on_link_died(
&mut self, type Error = Error;
_: kameo::prelude::WeakActorRef<Self>,
id: kameo::prelude::ActorId, async fn on_start(
_: kameo::prelude::ActorStopReason, args: Self::Args,
) -> Result<std::ops::ControlFlow<kameo::prelude::ActorStopReason>, Self::Error> { this: kameo::prelude::ActorRef<Self>,
let cancelled_pubkey = self ) -> Result<Self, Self::Error> {
.pending_client_approvals args.props
.iter() .actors
.find_map(|(k, v)| (v.controller.id() == id).then_some(k.clone())); .flow_coordinator
.ask(RegisterUserAgent {
if let Some(pubkey_bytes) = cancelled_pubkey { actor: this.clone(),
let Some(approval) = self.pending_client_approvals.remove(&pubkey_bytes) else { })
return Ok(std::ops::ControlFlow::Continue(())); .await
}; .map_err(|err| {
error!(
if let Err(e) = self ?err,
.sender "Failed to register user agent connection with flow coordinator"
.send(OutOfBand::ClientConnectionCancel { );
pubkey: approval.pubkey, Error::internal("Failed to register user agent connection with flow coordinator")
}) })?;
.await Ok(args)
{ }
error!(
?e, async fn on_link_died(
actor = "operator", &mut self,
event = "failed to announce client connection cancellation" _: kameo::prelude::WeakActorRef<Self>,
); id: kameo::prelude::ActorId,
} _: kameo::prelude::ActorStopReason,
} ) -> Result<std::ops::ControlFlow<kameo::prelude::ActorStopReason>, Self::Error> {
let cancelled_pubkey = self
Ok(std::ops::ControlFlow::Continue(())) .pending_client_approvals
} .iter()
} .find_map(|(k, v)| (v.controller.id() == id).then_some(*k));
if let Some(pubkey) = cancelled_pubkey {
self.pending_client_approvals.remove(&pubkey);
if let Err(e) = self
.sender
.send(OutOfBand::ClientConnectionCancel { pubkey })
.await
{
error!(
?e,
actor = "user_agent",
event = "failed to announce client connection cancellation"
);
}
}
Ok(std::ops::ControlFlow::Continue(()))
}
}

522
server/crates/arbiter-server/src/actors/user_agent/session/connection.rs Normal file
View File

@@ -0,0 +1,522 @@
use std::sync::Mutex;
use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
use diesel_async::{AsyncConnection, RunQueryDsl};
use kameo::error::SendError;
use kameo::messages;
use kameo::prelude::Context;
use tracing::{error, info};
use x25519_dalek::{EphemeralSecret, PublicKey};
use crate::actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer;
use crate::actors::keyholder::KeyHolderState;
use crate::actors::user_agent::session::Error;
use crate::db::models::{
EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
};
use crate::evm::policies::{Grant, SpecificGrant};
use crate::safe_cell::SafeCell;
use crate::{
actors::{
evm::{
ClientSignTransaction, Generate, ListWallets, SignTransactionError as EvmSignError,
UseragentCreateGrant, UseragentDeleteGrant, UseragentListGrants,
},
keyholder::{self, Bootstrap, TryUnseal},
user_agent::session::{
UserAgentSession,
state::{UnsealContext, UserAgentEvents, UserAgentStates},
},
},
safe_cell::SafeCellHandle as _,
};
impl UserAgentSession {
fn take_unseal_secret(&mut self) -> Result<(EphemeralSecret, PublicKey), Error> {
let UserAgentStates::WaitingForUnsealKey(unseal_context) = self.state.state() else {
error!("Received encrypted key in invalid state");
return Err(Error::internal("Invalid state for unseal encrypted key"));
};
let ephemeral_secret = {
#[allow(
clippy::unwrap_used,
reason = "Mutex poison is unrecoverable and should panic"
)]
let mut secret_lock = unseal_context.secret.lock().unwrap();
let secret = secret_lock.take();
match secret {
Some(secret) => secret,
None => {
drop(secret_lock);
error!("Ephemeral secret already taken");
return Err(Error::internal("Ephemeral secret already taken"));
}
}
};
Ok((ephemeral_secret, unseal_context.client_public_key))
}
fn decrypt_client_key_material(
ephemeral_secret: EphemeralSecret,
client_public_key: PublicKey,
nonce: &[u8],
ciphertext: &[u8],
associated_data: &[u8],
) -> Result<SafeCell<Vec<u8>>, ()> {
let nonce = XNonce::from_slice(nonce);
let shared_secret = ephemeral_secret.diffie_hellman(&client_public_key);
let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
let mut key_buffer = SafeCell::new(ciphertext.to_vec());
let decryption_result = key_buffer.write_inline(|write_handle| {
cipher.decrypt_in_place(nonce, associated_data, write_handle)
});
match decryption_result {
Ok(_) => Ok(key_buffer),
Err(err) => {
error!(?err, "Failed to decrypt encrypted key material");
Err(())
}
}
}
}
pub struct UnsealStartResponse {
pub server_pubkey: PublicKey,
}
#[derive(Debug, Error)]
pub enum UnsealError {
#[error("Invalid key provided for unsealing")]
InvalidKey,
#[error("Internal error during unsealing process")]
General(#[from] super::Error),
}
#[derive(Debug, Error)]
pub enum BootstrapError {
#[error("Invalid key provided for bootstrapping")]
InvalidKey,
#[error("Vault is already bootstrapped")]
AlreadyBootstrapped,
#[error("Internal error during bootstrapping process")]
General(#[from] super::Error),
}
#[derive(Debug, Error)]
pub enum SignTransactionError {
#[error("Policy evaluation failed")]
Vet(#[from] crate::evm::VetError),
#[error("Internal signing error")]
Internal,
}
#[derive(Debug, Error)]
pub enum GrantMutationError {
#[error("Vault is sealed")]
VaultSealed,
#[error("Internal grant mutation error")]
Internal,
}
#[messages]
impl UserAgentSession {
#[message]
pub async fn handle_unseal_request(
&mut self,
client_pubkey: x25519_dalek::PublicKey,
) -> Result<UnsealStartResponse, Error> {
let secret = EphemeralSecret::random();
let public_key = PublicKey::from(&secret);
self.transition(UserAgentEvents::UnsealRequest(UnsealContext {
secret: Mutex::new(Some(secret)),
client_public_key: client_pubkey,
}))?;
Ok(UnsealStartResponse {
server_pubkey: public_key,
})
}
#[message]
pub async fn handle_unseal_encrypted_key(
&mut self,
nonce: Vec<u8>,
ciphertext: Vec<u8>,
associated_data: Vec<u8>,
) -> Result<(), UnsealError> {
let (ephemeral_secret, client_public_key) = match self.take_unseal_secret() {
Ok(values) => values,
Err(Error::State) => {
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
return Err(UnsealError::InvalidKey);
}
Err(_err) => {
return Err(Error::internal("Failed to take unseal secret").into());
}
};
let seal_key_buffer = match Self::decrypt_client_key_material(
ephemeral_secret,
client_public_key,
&nonce,
&ciphertext,
&associated_data,
) {
Ok(buffer) => buffer,
Err(()) => {
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
return Err(UnsealError::InvalidKey);
}
};
match self
.props
.actors
.key_holder
.ask(TryUnseal {
seal_key_raw: seal_key_buffer,
})
.await
{
Ok(_) => {
info!("Successfully unsealed key with client-provided key");
self.transition(UserAgentEvents::ReceivedValidKey)?;
Ok(())
}
Err(SendError::HandlerError(keyholder::Error::InvalidKey)) => {
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
Err(UnsealError::InvalidKey)
}
Err(SendError::HandlerError(err)) => {
error!(?err, "Keyholder failed to unseal key");
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
Err(UnsealError::InvalidKey)
}
Err(err) => {
error!(?err, "Failed to send unseal request to keyholder");
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
Err(Error::internal("Vault actor error").into())
}
}
}
#[message]
pub(crate) async fn handle_bootstrap_encrypted_key(
&mut self,
nonce: Vec<u8>,
ciphertext: Vec<u8>,
associated_data: Vec<u8>,
) -> Result<(), BootstrapError> {
let (ephemeral_secret, client_public_key) = match self.take_unseal_secret() {
Ok(values) => values,
Err(Error::State) => {
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
return Err(BootstrapError::InvalidKey);
}
Err(err) => return Err(err.into()),
};
let seal_key_buffer = match Self::decrypt_client_key_material(
ephemeral_secret,
client_public_key,
&nonce,
&ciphertext,
&associated_data,
) {
Ok(buffer) => buffer,
Err(()) => {
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
return Err(BootstrapError::InvalidKey);
}
};
match self
.props
.actors
.key_holder
.ask(Bootstrap {
seal_key_raw: seal_key_buffer,
})
.await
{
Ok(_) => {
info!("Successfully bootstrapped vault with client-provided key");
self.transition(UserAgentEvents::ReceivedValidKey)?;
Ok(())
}
Err(SendError::HandlerError(keyholder::Error::AlreadyBootstrapped)) => {
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
Err(BootstrapError::AlreadyBootstrapped)
}
Err(SendError::HandlerError(err)) => {
error!(?err, "Keyholder failed to bootstrap vault");
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
Err(BootstrapError::InvalidKey)
}
Err(err) => {
error!(?err, "Failed to send bootstrap request to keyholder");
self.transition(UserAgentEvents::ReceivedInvalidKey)?;
Err(BootstrapError::General(Error::internal(
"Vault actor error",
)))
}
}
}
}
#[messages]
impl UserAgentSession {
#[message]
pub(crate) async fn handle_query_vault_state(&mut self) -> Result<KeyHolderState, Error> {
use crate::actors::keyholder::GetState;
let vault_state = match self.props.actors.key_holder.ask(GetState {}).await {
Ok(state) => state,
Err(err) => {
error!(?err, actor = "useragent", "keyholder.query.failed");
return Err(Error::internal("Vault is in broken state"));
}
};
Ok(vault_state)
}
}
#[messages]
impl UserAgentSession {
#[message]
pub(crate) async fn handle_evm_wallet_create(&mut self) -> Result<(i32, Address), Error> {
match self.props.actors.evm.ask(Generate {}).await {
Ok(address) => Ok(address),
Err(SendError::HandlerError(err)) => Err(Error::internal(format!(
"EVM wallet generation failed: {err}"
))),
Err(err) => {
error!(?err, "EVM actor unreachable during wallet create");
Err(Error::internal("EVM actor unreachable"))
}
}
}
#[message]
pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
match self.props.actors.evm.ask(ListWallets {}).await {
Ok(wallets) => Ok(wallets),
Err(err) => {
error!(?err, "EVM wallet list failed");
Err(Error::internal("Failed to list EVM wallets"))
}
}
}
}
#[messages]
impl UserAgentSession {
#[message]
pub(crate) async fn handle_grant_list(&mut self) -> Result<Vec<Grant<SpecificGrant>>, Error> {
match self.props.actors.evm.ask(UseragentListGrants {}).await {
Ok(grants) => Ok(grants),
Err(err) => {
error!(?err, "EVM grant list failed");
Err(Error::internal("Failed to list EVM grants"))
}
}
}
#[message]
pub(crate) async fn handle_grant_create(
&mut self,
basic: crate::evm::policies::SharedGrantSettings,
grant: crate::evm::policies::SpecificGrant,
) -> Result<i32, GrantMutationError> {
match self
.props
.actors
.evm
.ask(UseragentCreateGrant { basic, grant })
.await
{
Ok(grant_id) => Ok(grant_id),
Err(err) => {
error!(?err, "EVM grant create failed");
Err(GrantMutationError::Internal)
}
}
}
#[message]
pub(crate) async fn handle_grant_delete(
&mut self,
grant_id: i32,
) -> Result<(), GrantMutationError> {
match self
.props
.actors
.evm
.ask(UseragentDeleteGrant { grant_id })
.await
{
Ok(()) => Ok(()),
Err(err) => {
error!(?err, "EVM grant delete failed");
Err(GrantMutationError::Internal)
}
}
}
#[message]
pub(crate) async fn handle_sign_transaction(
&mut self,
client_id: i32,
wallet_address: Address,
transaction: TxEip1559,
) -> Result<Signature, SignTransactionError> {
match self
.props
.actors
.evm
.ask(ClientSignTransaction {
client_id,
wallet_address,
transaction,
})
.await
{
Ok(signature) => Ok(signature),
Err(SendError::HandlerError(EvmSignError::Vet(vet_error))) => {
Err(SignTransactionError::Vet(vet_error))
}
Err(err) => {
error!(?err, "EVM sign transaction failed in user-agent session");
Err(SignTransactionError::Internal)
}
}
}
#[message]
pub(crate) async fn handle_grant_evm_wallet_access(
&mut self,
entries: Vec<NewEvmWalletAccess>,
) -> Result<(), Error> {
let mut conn = self.props.db.get().await?;
conn.transaction(|conn| {
Box::pin(async move {
use crate::db::schema::evm_wallet_access;
for entry in entries {
diesel::insert_into(evm_wallet_access::table)
.values(&entry)
.on_conflict_do_nothing()
.execute(conn)
.await?;
}
Result::<_, Error>::Ok(())
})
})
.await?;
Ok(())
}
#[message]
pub(crate) async fn handle_revoke_evm_wallet_access(
&mut self,
entries: Vec<i32>,
) -> Result<(), Error> {
let mut conn = self.props.db.get().await?;
conn.transaction(|conn| {
Box::pin(async move {
use crate::db::schema::evm_wallet_access;
for entry in entries {
diesel::delete(evm_wallet_access::table)
.filter(evm_wallet_access::wallet_id.eq(entry))
.execute(conn)
.await?;
}
Result::<_, Error>::Ok(())
})
})
.await?;
Ok(())
}
#[message]
pub(crate) async fn handle_list_wallet_access(
&mut self,
) -> Result<Vec<EvmWalletAccess>, Error> {
let mut conn = self.props.db.get().await?;
use crate::db::schema::evm_wallet_access;
let access_entries = evm_wallet_access::table
.select(EvmWalletAccess::as_select())
.load::<_>(&mut conn)
.await?;
Ok(access_entries)
}
}
#[messages]
impl UserAgentSession {
#[message(ctx)]
pub(crate) async fn handle_new_client_approve(
&mut self,
approved: bool,
pubkey: ed25519_dalek::VerifyingKey,
ctx: &mut Context<Self, Result<(), Error>>,
) -> Result<(), Error> {
let pending_approval = match self.pending_client_approvals.remove(&pubkey) {
Some(approval) => approval,
None => {
error!("Received client connection response for unknown client");
return Err(Error::internal("Unknown client in connection response"));
}
};
pending_approval
.controller
.tell(ClientApprovalAnswer { approved })
.await
.map_err(|err| {
error!(
?err,
"Failed to send client approval response to controller"
);
Error::internal("Failed to send client approval response to controller")
})?;
ctx.actor_ref().unlink(&pending_approval.controller).await;
Ok(())
}
#[message]
pub(crate) async fn handle_sdk_client_list(
&mut self,
) -> Result<Vec<(ProgramClient, ProgramClientMetadata)>, Error> {
use crate::db::schema::{client_metadata, program_client};
let mut conn = self.props.db.get().await?;
let clients = program_client::table
.inner_join(client_metadata::table)
.select((
ProgramClient::as_select(),
ProgramClientMetadata::as_select(),
))
.load::<(ProgramClient, ProgramClientMetadata)>(&mut conn)
.await?;
Ok(clients)
}
}

27
server/crates/arbiter-server/src/actors/user_agent/session/state.rs Normal file
View File

@@ -0,0 +1,27 @@
use std::sync::Mutex;
use x25519_dalek::{EphemeralSecret, PublicKey};
pub struct UnsealContext {
pub client_public_key: PublicKey,
pub secret: Mutex<Option<EphemeralSecret>>,
}
smlang::statemachine!(
name: UserAgent,
custom_error: false,
transitions: {
*Idle + UnsealRequest(UnsealContext) / generate_temp_keypair = WaitingForUnsealKey(UnsealContext),
WaitingForUnsealKey(UnsealContext) + ReceivedValidKey = Unsealed,
WaitingForUnsealKey(UnsealContext) + ReceivedInvalidKey = Idle,
}
);
pub struct DummyContext;
impl UserAgentStateMachineContext for DummyContext {
#[allow(missing_docs)]
#[allow(clippy::unused_unit)]
fn generate_temp_keypair(&mut self, event_data: UnsealContext) -> Result<UnsealContext, ()> {
Ok(event_data)
}
}

115
server/crates/arbiter-server/src/context/mod.rs
View File

@@ -1,57 +1,58 @@
use crate::{ use std::sync::Arc;
actors::GlobalActors,
context::tls::TlsManager, use thiserror::Error;
db::{self},
}; use crate::{
actors::GlobalActors,
use std::sync::Arc; context::tls::TlsManager,
use thiserror::Error; db::{self},
};
pub mod tls;
pub mod tls;
#[derive(Error, Debug)]
pub enum InitError { #[derive(Error, Debug)]
#[error("Database setup failed: {0}")] pub enum InitError {
DatabaseSetup(#[from] db::DatabaseSetupError), #[error("Database setup failed: {0}")]
DatabaseSetup(#[from] db::DatabaseSetupError),
#[error("Connection acquire failed: {0}")]
DatabasePool(#[from] db::PoolError), #[error("Connection acquire failed: {0}")]
DatabasePool(#[from] db::PoolError),
#[error("Database query error: {0}")]
DatabaseQuery(#[from] diesel::result::Error), #[error("Database query error: {0}")]
DatabaseQuery(#[from] diesel::result::Error),
#[error("TLS initialization failed: {0}")]
Tls(#[from] tls::InitError), #[error("TLS initialization failed: {0}")]
Tls(#[from] tls::InitError),
#[error("Actor spawn failed: {0}")]
ActorSpawn(#[from] crate::actors::SpawnError), #[error("Actor spawn failed: {0}")]
ActorSpawn(#[from] crate::actors::SpawnError),
#[error("I/O Error: {0}")]
Io(#[from] std::io::Error), #[error("I/O Error: {0}")]
} Io(#[from] std::io::Error),
}
pub struct __ServerContextInner {
pub db: db::DatabasePool, pub struct _ServerContextInner {
pub tls: TlsManager, pub db: db::DatabasePool,
pub actors: GlobalActors, pub tls: TlsManager,
} pub actors: GlobalActors,
#[derive(Clone)] }
pub struct ServerContext(Arc<__ServerContextInner>); #[derive(Clone)]
pub struct ServerContext(Arc<_ServerContextInner>);
impl std::ops::Deref for ServerContext {
type Target = __ServerContextInner; impl std::ops::Deref for ServerContext {
type Target = _ServerContextInner;
fn deref(&self) -> &Self::Target {
&self.0 fn deref(&self) -> &Self::Target {
} &self.0
} }
}
impl ServerContext {
pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> { impl ServerContext {
Ok(Self(Arc::new(__ServerContextInner { pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> {
actors: GlobalActors::spawn(db.clone()).await?, Ok(Self(Arc::new(_ServerContextInner {
tls: TlsManager::new(db.clone()).await?, actors: GlobalActors::spawn(db.clone()).await?,
db, tls: TlsManager::new(db.clone()).await?,
}))) db,
} })))
} }
}

507
server/crates/arbiter-server/src/context/tls.rs
View File

@@ -1,257 +1,250 @@
use crate::db::{ use std::{net::Ipv4Addr, string::FromUtf8Error};
self,
models::{NewTlsHistory, TlsHistory}, use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper as _};
schema::{ use diesel_async::{AsyncConnection, RunQueryDsl};
arbiter_settings,
tls_history::{self}, use pem::Pem;
}, use rcgen::{
}; BasicConstraints, Certificate, CertificateParams, CertifiedIssuer, DistinguishedName, DnType,
IsCa, Issuer, KeyPair, KeyUsagePurpose, SanType,
use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper as _}; };
use diesel_async::{AsyncConnection, RunQueryDsl}; use rustls::pki_types::pem::PemObject;
use pem::Pem; use thiserror::Error;
use rcgen::{ use tonic::transport::CertificateDer;
BasicConstraints, Certificate, CertificateParams, CertifiedIssuer, DistinguishedName, DnType,
IsCa, Issuer, KeyPair, KeyUsagePurpose, SanType, use crate::db::{
}; self,
use rustls::pki_types::pem::PemObject; models::{NewTlsHistory, TlsHistory},
use std::{net::Ipv4Addr, string::FromUtf8Error}; schema::{
use thiserror::Error; arbiter_settings,
use tonic::transport::CertificateDer; tls_history::{self},
},
const ENCODE_CONFIG: pem::EncodeConfig = { };
let line_ending = if cfg!(target_family = "windows") {
pem::LineEnding::CRLF const ENCODE_CONFIG: pem::EncodeConfig = {
} else { let line_ending = match cfg!(target_family = "windows") {
pem::LineEnding::LF true => pem::LineEnding::CRLF,
}; false => pem::LineEnding::LF,
pem::EncodeConfig::new().set_line_ending(line_ending) };
}; pem::EncodeConfig::new().set_line_ending(line_ending)
};
#[derive(Error, Debug)]
pub enum InitError { #[derive(Error, Debug)]
#[error("Key generation error during TLS initialization: {0}")] pub enum InitError {
KeyGeneration(#[from] rcgen::Error), #[error("Key generation error during TLS initialization: {0}")]
KeyGeneration(#[from] rcgen::Error),
#[error("Key invalid format: {0}")]
KeyInvalidFormat(#[from] FromUtf8Error), #[error("Key invalid format: {0}")]
KeyInvalidFormat(#[from] FromUtf8Error),
#[error("Key deserialization error: {0}")]
KeyDeserializationError(rcgen::Error), #[error("Key deserialization error: {0}")]
KeyDeserializationError(rcgen::Error),
#[error("Database error during TLS initialization: {0}")]
DatabaseError(#[from] diesel::result::Error), #[error("Database error during TLS initialization: {0}")]
DatabaseError(#[from] diesel::result::Error),
#[error("Pem deserialization error during TLS initialization: {0}")]
PemDeserializationError(#[from] rustls::pki_types::pem::Error), #[error("Pem deserialization error during TLS initialization: {0}")]
PemDeserializationError(#[from] rustls::pki_types::pem::Error),
#[error("Database pool acquire error during TLS initialization: {0}")]
DatabasePoolAcquire(#[from] db::PoolError), #[error("Database pool acquire error during TLS initialization: {0}")]
} DatabasePoolAcquire(#[from] db::PoolError),
}
pub type PemCert = String;
pub type PemCert = String;
pub fn encode_cert_to_pem(cert: &CertificateDer<'_>) -> PemCert {
pem::encode_config(&Pem::new("CERTIFICATE", cert.to_vec()), ENCODE_CONFIG) pub fn encode_cert_to_pem(cert: &CertificateDer) -> PemCert {
} pem::encode_config(&Pem::new("CERTIFICATE", cert.to_vec()), ENCODE_CONFIG)
}
#[expect(
unused, #[allow(unused)]
reason = "may be needed for future cert rotation implementation" struct SerializedTls {
)] cert_pem: PemCert,
struct SerializedTls { cert_key_pem: String,
cert_pem: PemCert, }
cert_key_pem: String,
} struct TlsCa {
issuer: Issuer<'static, KeyPair>,
struct TlsCa { cert: CertificateDer<'static>,
issuer: Issuer<'static, KeyPair>, }
cert: CertificateDer<'static>,
} impl TlsCa {
fn generate() -> Result<Self, InitError> {
impl TlsCa { let keypair = KeyPair::generate()?;
fn generate() -> Result<Self, InitError> { let mut params = CertificateParams::new(["Arbiter Instance CA".into()])?;
let keypair = KeyPair::generate()?; params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
let mut params = CertificateParams::new(["Arbiter Instance CA".into()])?; params.key_usages = vec![
params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained); KeyUsagePurpose::KeyCertSign,
params.key_usages = vec![ KeyUsagePurpose::CrlSign,
KeyUsagePurpose::KeyCertSign, KeyUsagePurpose::DigitalSignature,
KeyUsagePurpose::CrlSign, ];
KeyUsagePurpose::DigitalSignature,
]; let mut dn = DistinguishedName::new();
dn.push(DnType::CommonName, "Arbiter Instance CA");
let mut dn = DistinguishedName::new(); params.distinguished_name = dn;
dn.push(DnType::CommonName, "Arbiter Instance CA"); let certified_issuer = CertifiedIssuer::self_signed(params, keypair)?;
params.distinguished_name = dn;
let certified_issuer = CertifiedIssuer::self_signed(params, keypair)?; let cert_key_pem = certified_issuer.key().serialize_pem();
let cert_key_pem = certified_issuer.key().serialize_pem(); #[allow(
clippy::unwrap_used,
#[expect( reason = "Broken cert couldn't bootstrap server anyway"
clippy::unwrap_used, )]
reason = "Broken cert couldn't bootstrap server anyway" let issuer = Issuer::from_ca_cert_pem(
)] &certified_issuer.pem(),
let issuer = Issuer::from_ca_cert_pem( KeyPair::from_pem(cert_key_pem.as_ref()).unwrap(),
&certified_issuer.pem(), )
KeyPair::from_pem(cert_key_pem.as_ref()).unwrap(), .unwrap();
)
.unwrap(); Ok(Self {
issuer,
Ok(Self { cert: certified_issuer.der().clone(),
issuer, })
cert: certified_issuer.der().clone(), }
}) fn generate_leaf(&self) -> Result<TlsCert, InitError> {
} let cert_key = KeyPair::generate()?;
fn generate_leaf(&self) -> Result<TlsCert, InitError> { let mut params = CertificateParams::new(["Arbiter Instance Leaf".into()])?;
let cert_key = KeyPair::generate()?; params.is_ca = IsCa::NoCa;
let mut params = CertificateParams::new(["Arbiter Instance Leaf".into()])?; params.key_usages = vec![
params.is_ca = IsCa::NoCa; KeyUsagePurpose::DigitalSignature,
params.key_usages = vec![ KeyUsagePurpose::KeyEncipherment,
KeyUsagePurpose::DigitalSignature, ];
KeyUsagePurpose::KeyEncipherment, params
]; .subject_alt_names
params .push(SanType::IpAddress(Ipv4Addr::LOCALHOST.into()));
.subject_alt_names
.push(SanType::IpAddress(Ipv4Addr::LOCALHOST.into())); let mut dn = DistinguishedName::new();
dn.push(DnType::CommonName, "Arbiter Instance Leaf");
let mut dn = DistinguishedName::new(); params.distinguished_name = dn;
dn.push(DnType::CommonName, "Arbiter Instance Leaf");
params.distinguished_name = dn; let new_cert = params.signed_by(&cert_key, &self.issuer)?;
let new_cert = params.signed_by(&cert_key, &self.issuer)?; Ok(TlsCert {
cert: new_cert,
Ok(TlsCert { cert_key,
cert: new_cert, })
cert_key, }
})
} #[allow(unused)]
fn serialize(&self) -> Result<SerializedTls, InitError> {
#[expect( let cert_key_pem = self.issuer.key().serialize_pem();
unused, Ok(SerializedTls {
clippy::unnecessary_wraps, cert_pem: encode_cert_to_pem(&self.cert),
reason = "may be needed for future cert rotation implementation" cert_key_pem,
)] })
fn serialize(&self) -> Result<SerializedTls, InitError> { }
let cert_key_pem = self.issuer.key().serialize_pem();
Ok(SerializedTls { #[allow(unused)]
cert_pem: encode_cert_to_pem(&self.cert), fn try_deserialize(cert_pem: &str, cert_key_pem: &str) -> Result<Self, InitError> {
cert_key_pem, let keypair =
}) KeyPair::from_pem(cert_key_pem).map_err(InitError::KeyDeserializationError)?;
} let issuer = Issuer::from_ca_cert_pem(cert_pem, keypair)?;
Ok(Self {
#[expect( issuer,
unused, cert: CertificateDer::from_pem_slice(cert_pem.as_bytes())?,
reason = "may be needed for future cert rotation implementation" })
)] }
fn try_deserialize(cert_pem: &str, cert_key_pem: &str) -> Result<Self, InitError> { }
let keypair =
KeyPair::from_pem(cert_key_pem).map_err(InitError::KeyDeserializationError)?; struct TlsCert {
let issuer = Issuer::from_ca_cert_pem(cert_pem, keypair)?; cert: Certificate,
Ok(Self { cert_key: KeyPair,
issuer, }
cert: CertificateDer::from_pem_slice(cert_pem.as_bytes())?,
}) // TODO: Implement cert rotation
} pub struct TlsManager {
} cert: CertificateDer<'static>,
keypair: KeyPair,
struct TlsCert { ca_cert: CertificateDer<'static>,
cert: Certificate, _db: db::DatabasePool,
cert_key: KeyPair, }
}
impl TlsManager {
// TODO: Implement cert rotation pub async fn generate_new(db: &db::DatabasePool) -> Result<Self, InitError> {
pub struct TlsManager { let ca = TlsCa::generate()?;
cert: CertificateDer<'static>, let new_cert = ca.generate_leaf()?;
keypair: KeyPair,
ca_cert: CertificateDer<'static>, {
_db: db::DatabasePool, let mut conn = db.get().await?;
} conn.transaction(|conn| {
Box::pin(async {
impl TlsManager { let new_tls_history = NewTlsHistory {
pub async fn generate_new(db: &db::DatabasePool) -> Result<Self, InitError> { cert: new_cert.cert.pem(),
let ca = TlsCa::generate()?; cert_key: new_cert.cert_key.serialize_pem(),
let new_cert = ca.generate_leaf()?; ca_cert: encode_cert_to_pem(&ca.cert),
ca_key: ca.issuer.key().serialize_pem(),
{ };
let mut conn = db.get().await?;
conn.transaction(async |conn| { let inserted_tls_history: i32 = diesel::insert_into(tls_history::table)
let new_tls_history = NewTlsHistory { .values(&new_tls_history)
cert: new_cert.cert.pem(), .returning(tls_history::id)
cert_key: new_cert.cert_key.serialize_pem(), .get_result(conn)
ca_cert: encode_cert_to_pem(&ca.cert), .await?;
ca_key: ca.issuer.key().serialize_pem(),
}; diesel::update(arbiter_settings::table)
.set(arbiter_settings::tls_id.eq(inserted_tls_history))
let inserted_tls_history: i32 = diesel::insert_into(tls_history::table) .execute(conn)
.values(&new_tls_history) .await?;
.returning(tls_history::id)
.get_result(&mut *conn) Result::<_, diesel::result::Error>::Ok(())
.await?; })
})
diesel::update(arbiter_settings::table) .await?;
.set(arbiter_settings::tls_id.eq(inserted_tls_history)) }
.execute(&mut *conn)
.await?; Ok(Self {
cert: new_cert.cert.der().clone(),
Result::<_, diesel::result::Error>::Ok(()) keypair: new_cert.cert_key,
}) ca_cert: ca.cert,
.await?; _db: db.clone(),
} })
}
Ok(Self {
cert: new_cert.cert.der().clone(), pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> {
keypair: new_cert.cert_key, let cert_data: Option<TlsHistory> = {
ca_cert: ca.cert, let mut conn = db.get().await?;
_db: db.clone(), arbiter_settings::table
}) .left_join(tls_history::table)
} .select(Option::<TlsHistory>::as_select())
.first(&mut conn)
pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> { .await?
let cert_data: Option<TlsHistory> = { };
let mut conn = db.get().await?;
arbiter_settings::table match cert_data {
.left_join(tls_history::table) Some(data) => {
.select(Option::<TlsHistory>::as_select()) let try_load = || -> Result<_, Box<dyn std::error::Error>> {
.first(&mut conn) let keypair = KeyPair::from_pem(&data.cert_key)?;
.await? let cert = CertificateDer::from_pem_slice(data.cert.as_bytes())?;
}; let ca_cert = CertificateDer::from_pem_slice(data.ca_cert.as_bytes())?;
Ok(Self {
match cert_data { cert,
Some(data) => { keypair,
let try_load = || -> Result<_, Box<dyn std::error::Error>> { ca_cert,
let keypair = KeyPair::from_pem(&data.cert_key)?; _db: db.clone(),
let cert = CertificateDer::from_pem_slice(data.cert.as_bytes())?; })
let ca_cert = CertificateDer::from_pem_slice(data.ca_cert.as_bytes())?; };
Ok(Self { match try_load() {
cert, Ok(manager) => Ok(manager),
keypair, Err(e) => {
ca_cert, eprintln!("Failed to load existing TLS certs: {e}. Generating new ones.");
_db: db.clone(), Self::generate_new(&db).await
}) }
}; }
match try_load() { }
Ok(manager) => Ok(manager), None => Self::generate_new(&db).await,
Err(e) => { }
eprintln!("Failed to load existing TLS certs: {e}. Generating new ones."); }
Self::generate_new(&db).await
} pub fn cert(&self) -> &CertificateDer<'static> {
} &self.cert
} }
None => Self::generate_new(&db).await, pub fn ca_cert(&self) -> &CertificateDer<'static> {
} &self.ca_cert
} }
pub const fn cert(&self) -> &CertificateDer<'static> { pub fn cert_pem(&self) -> PemCert {
&self.cert encode_cert_to_pem(&self.cert)
} }
pub const fn ca_cert(&self) -> &CertificateDer<'static> { pub fn key_pem(&self) -> String {
&self.ca_cert self.keypair.serialize_pem()
} }
}
pub fn cert_pem(&self) -> PemCert {
encode_cert_to_pem(&self.cert)
}
pub fn key_pem(&self) -> String {
self.keypair.serialize_pem()
}
}

6
server/crates/arbiter-server/src/crypto/encryption/mod.rs
View File

@@ -1,3 +1,3 @@
pub mod v1; pub mod v1;
pub use v1::*; pub use v1::*;

211
server/crates/arbiter-server/src/crypto/encryption/v1.rs
View File

@@ -1,102 +1,109 @@
use argon2::password_hash::Salt as ArgonSalt; use argon2::password_hash::Salt as ArgonSalt;
use rand::{
Rng as _, SeedableRng, use rand::{
rngs::{StdRng, SysRng}, Rng as _, SeedableRng,
}; rngs::{StdRng, SysRng},
};
pub const ROOT_KEY_TAG: &[u8] = b"arbiter/seal/v1";
pub const TAG: &[u8] = b"arbiter/private-key/v1"; pub const ROOT_KEY_TAG: &[u8] = "arbiter/seal/v1".as_bytes();
pub const TAG: &[u8] = "arbiter/private-key/v1".as_bytes();
pub const NONCE_LENGTH: usize = 24;
pub const NONCE_LENGTH: usize = 24;
#[derive(Default)]
pub struct Nonce(pub [u8; NONCE_LENGTH]); #[derive(Default)]
impl Nonce { pub struct Nonce(pub [u8; NONCE_LENGTH]);
pub fn increment(&mut self) { impl Nonce {
for i in (0..self.0.len()).rev() { pub fn increment(&mut self) {
if let Some(byte) = self.0.get_mut(i) { for i in (0..self.0.len()).rev() {
if *byte == 0xFF { if self.0[i] == 0xFF {
*byte = 0; self.0[i] = 0;
} else { } else {
*byte += 1; self.0[i] += 1;
break; break;
} }
} }
} }
}
pub fn to_vec(&self) -> Vec<u8> {
pub fn to_vec(&self) -> Vec<u8> { self.0.to_vec()
self.0.to_vec() }
} }
} impl<'a> TryFrom<&'a [u8]> for Nonce {
impl<'a> TryFrom<&'a [u8]> for Nonce { type Error = ();
type Error = ();
fn try_from(value: &'a [u8]) -> Result<Self, Self::Error> {
fn try_from(value: &'a [u8]) -> Result<Self, Self::Error> { if value.len() != NONCE_LENGTH {
if value.len() != NONCE_LENGTH { return Err(());
return Err(()); }
} let mut nonce = [0u8; NONCE_LENGTH];
let mut nonce = [0u8; NONCE_LENGTH]; nonce.copy_from_slice(value);
nonce.copy_from_slice(value); Ok(Self(nonce))
Ok(Self(nonce)) }
} }
}
pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];
pub type Salt = [u8; ArgonSalt::RECOMMENDED_LENGTH];
pub fn generate_salt() -> Salt {
pub fn generate_salt() -> Salt { let mut salt = Salt::default();
let mut salt = Salt::default(); #[allow(
let mut rng = clippy::unwrap_used,
StdRng::try_from_rng(&mut SysRng).expect("Rng failure is unrecoverable and should panic"); reason = "Rng failure is unrecoverable and should panic"
rng.fill_bytes(&mut salt); )]
salt let mut rng = StdRng::try_from_rng(&mut SysRng).unwrap();
} rng.fill_bytes(&mut salt);
salt
#[cfg(test)] }
mod tests {
use super::*; #[cfg(test)]
use crate::crypto::derive_key; mod tests {
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _}; use std::ops::Deref as _;
#[test] use super::*;
fn derive_seal_key_deterministic() { use crate::{
static PASSWORD: &[u8] = b"password"; crypto::derive_key,
let password = SafeCell::new(PASSWORD.to_vec()); safe_cell::{SafeCell, SafeCellHandle as _},
let password2 = SafeCell::new(PASSWORD.to_vec()); };
let salt = generate_salt();
#[test]
let mut key1 = derive_key(password, &salt); pub fn derive_seal_key_deterministic() {
let mut key2 = derive_key(password2, &salt); static PASSWORD: &[u8] = b"password";
let password = SafeCell::new(PASSWORD.to_vec());
let key1_reader = key1.0.read(); let password2 = SafeCell::new(PASSWORD.to_vec());
let key2_reader = key2.0.read(); let salt = generate_salt();
assert_eq!(&*key1_reader, &*key2_reader); let mut key1 = derive_key(password, &salt);
} let mut key2 = derive_key(password2, &salt);
#[test] let key1_reader = key1.0.read();
fn successful_derive() { let key2_reader = key2.0.read();
static PASSWORD: &[u8] = b"password";
let password = SafeCell::new(PASSWORD.to_vec()); assert_eq!(key1_reader.deref(), key2_reader.deref());
let salt = generate_salt(); }
let mut key = derive_key(password, &salt); #[test]
let key_reader = key.0.read(); pub fn successful_derive() {
static PASSWORD: &[u8] = b"password";
assert_ne!(key_reader.as_slice(), &[0u8; 32][..]); let password = SafeCell::new(PASSWORD.to_vec());
} let salt = generate_salt();
#[test] let mut key = derive_key(password, &salt);
// We should fuzz this let key_reader = key.0.read();
pub fn nonce_increment() { let key_ref = key_reader.deref();
let mut nonce = Nonce([0u8; NONCE_LENGTH]);
nonce.increment(); assert_ne!(key_ref.as_slice(), &[0u8; 32][..]);
}
assert_eq!(
nonce.0, #[test]
[ // We should fuzz this
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1 pub fn test_nonce_increment() {
] let mut nonce = Nonce([0u8; NONCE_LENGTH]);
); nonce.increment();
}
} assert_eq!(
nonce.0,
[
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1
]
);
}
}

6
server/crates/arbiter-server/src/crypto/integrity/mod.rs
View File

@@ -1,3 +1,3 @@
pub mod v1; pub mod v1;
pub use v1::*; pub use v1::*;

653
server/crates/arbiter-server/src/crypto/integrity/v1.rs
View File

@@ -1,334 +1,319 @@
use crate::{ use crate::{actors::keyholder, crypto::KeyCell,safe_cell::SafeCellHandle as _};
actors::vault::{self, GetState, SignIntegrity, Vault, VerifyIntegrity}, use chacha20poly1305::Key;
db::{ use hmac::{Hmac, Mac as _};
self, use serde::Serialize;
models::{IntegrityEnvelope, NewIntegrityEnvelope}, use sha2::Sha256;
schema::integrity_envelope,
}, use diesel::{ExpressionMethods as _, QueryDsl, dsl::insert_into, sqlite::Sqlite};
}; use diesel_async::{AsyncConnection, RunQueryDsl};
use arbiter_crypto::hashing::Hashable; use kameo::{actor::ActorRef, error::SendError};
use sha2::Digest as _;
use diesel::{ExpressionMethods as _, QueryDsl, dsl::insert_into, sqlite::Sqlite};
use diesel_async::{AsyncConnection, RunQueryDsl}; use crate::{
use hmac::Hmac; actors::keyholder::{KeyHolder, SignIntegrity, VerifyIntegrity},
use kameo::{actor::ActorRef, error::SendError}; db::{
use sha2::{Digest as _, Sha256}; self,
models::{IntegrityEnvelope, NewIntegrityEnvelope},
#[derive(Debug, thiserror::Error)] schema::integrity_envelope,
pub enum Error { },
#[error("Database error: {0}")] };
Database(#[from] db::DatabaseError),
#[derive(Debug, thiserror::Error)]
#[error("Vault error: {0}")] pub enum Error {
Vault(#[from] vault::Error), #[error("Database error: {0}")]
Database(#[from] db::DatabaseError),
#[error("Vault mailbox error")]
VaultSend, #[error("KeyHolder error: {0}")]
Keyholder(#[from] keyholder::Error),
#[error("Integrity envelope is missing for entity {entity_kind}")]
MissingEnvelope { entity_kind: &'static str }, #[error("KeyHolder mailbox error")]
KeyholderSend,
#[error(
"Integrity payload version mismatch for entity {entity_kind}: expected {expected}, found {found}" #[error("Integrity envelope is missing for entity {entity_kind}")]
)] MissingEnvelope { entity_kind: &'static str },
PayloadVersionMismatch {
entity_kind: &'static str, #[error(
expected: i32, "Integrity payload version mismatch for entity {entity_kind}: expected {expected}, found {found}"
found: i32, )]
}, PayloadVersionMismatch {
entity_kind: &'static str,
#[error("Integrity MAC mismatch for entity {entity_kind}")] expected: i32,
MacMismatch { entity_kind: &'static str }, found: i32,
} },
#[derive(Debug, Clone, Copy, PartialEq, Eq)] #[error("Integrity MAC mismatch for entity {entity_kind}")]
pub enum AttestationStatus { MacMismatch { entity_kind: &'static str },
Attested,
Unavailable, #[error("Payload serialization error: {0}")]
} PayloadSerialization(#[from] postcard::Error),
}
pub const CURRENT_PAYLOAD_VERSION: i32 = 1;
pub const INTEGRITY_SUBKEY_TAG: &[u8] = b"arbiter/db-integrity-key/v1"; #[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AttestationStatus {
pub type HmacSha256 = Hmac<Sha256>; Attested,
Unavailable,
pub trait Integrable: Hashable { }
const KIND: &'static str;
const VERSION: i32 = 1; pub const CURRENT_PAYLOAD_VERSION: i32 = 1;
} pub const INTEGRITY_SUBKEY_TAG: &[u8] = b"arbiter/db-integrity-key/v1";
fn payload_hash(payload: &impl Hashable) -> [u8; 32] { pub type HmacSha256 = Hmac<Sha256>;
let mut hasher = Sha256::new();
payload.hash(&mut hasher); pub trait Integrable: Serialize {
hasher.finalize().into() const KIND: &'static str;
} const VERSION: i32 = 1;
}
fn push_len_prefixed(out: &mut Vec<u8>, bytes: &[u8]) {
#[expect( fn payload_hash(payload: &[u8]) -> [u8; 32] {
clippy::cast_possible_truncation, Sha256::digest(payload).into()
clippy::as_conversions, }
reason = "fixme! #85"
)] fn push_len_prefixed(out: &mut Vec<u8>, bytes: &[u8]) {
out.extend_from_slice(&(bytes.len() as u32).to_be_bytes()); out.extend_from_slice(&(bytes.len() as u32).to_be_bytes());
out.extend_from_slice(bytes); out.extend_from_slice(bytes);
} }
fn build_mac_input( fn build_mac_input(
entity_kind: &str, entity_kind: &str,
entity_id: &[u8], entity_id: &[u8],
payload_version: i32, payload_version: i32,
payload_hash: &[u8; 32], payload_hash: &[u8; 32],
) -> Vec<u8> { ) -> Vec<u8> {
let mut out = Vec::with_capacity(8 + entity_kind.len() + entity_id.len() + 32); let mut out = Vec::with_capacity(8 + entity_kind.len() + entity_id.len() + 32);
push_len_prefixed(&mut out, entity_kind.as_bytes()); push_len_prefixed(&mut out, entity_kind.as_bytes());
push_len_prefixed(&mut out, entity_id); push_len_prefixed(&mut out, entity_id);
out.extend_from_slice(&payload_version.to_be_bytes()); out.extend_from_slice(&payload_version.to_be_bytes());
out.extend_from_slice(payload_hash); out.extend_from_slice(payload_hash);
out out
} }
pub trait IntoId { pub trait IntoId {
fn into_id(self) -> Vec<u8>; fn into_id(self) -> Vec<u8>;
} }
impl IntoId for i32 { impl IntoId for i32 {
fn into_id(self) -> Vec<u8> { fn into_id(self) -> Vec<u8> {
self.to_be_bytes().to_vec() self.to_be_bytes().to_vec()
} }
} }
impl IntoId for &'_ [u8] { impl IntoId for &'_ [u8] {
fn into_id(self) -> Vec<u8> { fn into_id(self) -> Vec<u8> {
self.to_vec() self.to_vec()
} }
} }
pub async fn sign_entity<E: Integrable>( pub async fn sign_entity<E: Integrable>(
conn: &mut impl AsyncConnection<Backend = Sqlite>, conn: &mut impl AsyncConnection<Backend = Sqlite>,
vault: &ActorRef<Vault>, keyholder: &ActorRef<KeyHolder>,
entity: &E, entity: &E,
entity_id: impl IntoId, entity_id: impl IntoId,
) -> Result<(), Error> { ) -> Result<(), Error> {
let payload_hash = payload_hash(&entity); let payload = postcard::to_stdvec(entity)?;
let payload_hash = payload_hash(&payload);
let entity_id = entity_id.into_id();
let entity_id = entity_id.into_id();
let mac_input = build_mac_input(E::KIND, &entity_id, E::VERSION, &payload_hash);
let mac_input = build_mac_input(E::KIND, &entity_id, E::VERSION, &payload_hash);
let (key_version, mac) =
vault let (key_version, mac) = keyholder
.ask(SignIntegrity { mac_input }) .ask(SignIntegrity { mac_input })
.await .await
.map_err(|err| match err { .map_err(|err| match err {
SendError::HandlerError(inner) => Error::Vault(inner), kameo::error::SendError::HandlerError(inner) => Error::Keyholder(inner),
_ => Error::VaultSend, _ => Error::KeyholderSend,
})?; })?;
insert_into(integrity_envelope::table) insert_into(integrity_envelope::table)
.values(NewIntegrityEnvelope { .values(NewIntegrityEnvelope {
entity_kind: E::KIND.to_owned(), entity_kind: E::KIND.to_owned(),
entity_id, entity_id: entity_id,
payload_version: E::VERSION, payload_version: E::VERSION ,
key_version, key_version,
mac: mac.clone(), mac: mac.to_vec(),
}) })
.on_conflict(( .on_conflict((
integrity_envelope::entity_id, integrity_envelope::entity_id,
integrity_envelope::entity_kind, integrity_envelope::entity_kind,
)) ))
.do_update() .do_update()
.set(( .set((
integrity_envelope::payload_version.eq(E::VERSION), integrity_envelope::payload_version.eq(E::VERSION),
integrity_envelope::key_version.eq(key_version), integrity_envelope::key_version.eq(key_version),
integrity_envelope::mac.eq(mac), integrity_envelope::mac.eq(mac),
)) ))
.execute(conn) .execute(conn)
.await .await
.map_err(db::DatabaseError::from)?; .map_err(db::DatabaseError::from)?;
Ok(()) Ok(())
} }
pub async fn verify_entity<E: Integrable>( pub async fn verify_entity<E: Integrable>(
conn: &mut impl AsyncConnection<Backend = Sqlite>, conn: &mut impl AsyncConnection<Backend = Sqlite>,
vault: &ActorRef<Vault>, keyholder: &ActorRef<KeyHolder>,
entity: &E, entity: &E,
entity_id: impl IntoId, entity_id: impl IntoId,
) -> Result<AttestationStatus, Error> { ) -> Result<AttestationStatus, Error> {
let entity_id = entity_id.into_id(); let entity_id = entity_id.into_id();
let envelope: IntegrityEnvelope = integrity_envelope::table let envelope: IntegrityEnvelope = integrity_envelope::table
.filter(integrity_envelope::entity_kind.eq(E::KIND)) .filter(integrity_envelope::entity_kind.eq(E::KIND))
.filter(integrity_envelope::entity_id.eq(&entity_id)) .filter(integrity_envelope::entity_id.eq(&entity_id))
.first(conn) .first(conn)
.await .await
.map_err(|err| match err { .map_err(|err| match err {
diesel::result::Error::NotFound => Error::MissingEnvelope { diesel::result::Error::NotFound => Error::MissingEnvelope { entity_kind: E::KIND },
entity_kind: E::KIND, other => Error::Database(db::DatabaseError::from(other)),
}, })?;
other => Error::Database(db::DatabaseError::from(other)),
})?; if envelope.payload_version != E::VERSION {
return Err(Error::PayloadVersionMismatch {
if envelope.payload_version != E::VERSION { entity_kind: E::KIND,
return Err(Error::PayloadVersionMismatch { expected: E::VERSION,
entity_kind: E::KIND, found: envelope.payload_version,
expected: E::VERSION, });
found: envelope.payload_version, }
});
} let payload = postcard::to_stdvec(entity)?;
let payload_hash = payload_hash(&payload);
let payload_hash = payload_hash(&entity); let mac_input = build_mac_input(
let mac_input = build_mac_input(E::KIND, &entity_id, envelope.payload_version, &payload_hash); E::KIND,
&entity_id,
let result = vault envelope.payload_version,
.ask(VerifyIntegrity { &payload_hash,
mac_input, );
expected_mac: envelope.mac,
key_version: envelope.key_version, let result = keyholder
}) .ask(VerifyIntegrity {
.await; mac_input,
expected_mac: envelope.mac,
match result { key_version: envelope.key_version,
Ok(true) => Ok(AttestationStatus::Attested), })
Ok(false) => Err(Error::MacMismatch { .await
entity_kind: E::KIND, ;
}),
Err(SendError::HandlerError(vault::Error::Sealed)) => Ok(AttestationStatus::Unavailable), match result {
Err(_) => Err(Error::VaultSend), Ok(true) => Ok(AttestationStatus::Attested),
} Ok(false) => Err(Error::MacMismatch { entity_kind: E::KIND }),
} Err(SendError::HandlerError(keyholder::Error::NotBootstrapped)) => Ok(AttestationStatus::Unavailable),
Err(_) => Err(Error::KeyholderSend),
pub async fn is_signing_available(vault: &ActorRef<Vault>) -> Result<bool, Error> { }
let state = vault.ask(GetState).await.map_err(|_| Error::VaultSend)?; }
Ok(matches!(state, vault::VaultState::Unsealed))
} #[cfg(test)]
mod tests {
#[cfg(test)] use diesel::{ExpressionMethods as _, QueryDsl};
mod tests { use diesel_async::RunQueryDsl;
use diesel::{ExpressionMethods as _, QueryDsl}; use kameo::{actor::ActorRef, prelude::Spawn};
use diesel_async::RunQueryDsl;
use kameo::{actor::ActorRef, prelude::Spawn}; use crate::{
actors::keyholder::{Bootstrap, KeyHolder},
use crate::{ db::{self, schema},
actors::{ safe_cell::{SafeCell, SafeCellHandle as _},
GlobalActors, };
vault::{Bootstrap, Vault},
}, use super::{Error, Integrable, sign_entity, verify_entity};
db::{self, schema},
}; #[derive(Clone, serde::Serialize)]
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _}; struct DummyEntity {
payload_version: i32,
use super::{Error, Integrable, sign_entity, verify_entity}; payload: Vec<u8>,
#[derive(Clone, arbiter_macros::Hashable)] }
struct DummyEntity {
payload_version: i32, impl Integrable for DummyEntity {
payload: Vec<u8>, const KIND: &'static str = "dummy_entity";
} }
impl Integrable for DummyEntity {
const KIND: &'static str = "dummy_entity"; async fn bootstrapped_keyholder(db: &db::DatabasePool) -> ActorRef<KeyHolder> {
} let actor = KeyHolder::spawn(KeyHolder::new(db.clone()).await.unwrap());
actor
async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> { .ask(Bootstrap {
let actor = Vault::spawn( seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
Vault::new(db.clone(), GlobalActors::spawn_message_bus()) })
.await .await
.unwrap(), .unwrap();
); actor
actor }
.ask(Bootstrap {
seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()), #[tokio::test]
}) async fn sign_writes_envelope_and_verify_passes() {
.await let db = db::create_test_pool().await;
.unwrap(); let keyholder = bootstrapped_keyholder(&db).await;
actor let mut conn = db.get().await.unwrap();
}
const ENTITY_ID: &[u8] = b"entity-id-7";
#[tokio::test]
async fn sign_writes_envelope_and_verify_passes() { let entity = DummyEntity {
const ENTITY_ID: &[u8] = b"entity-id-7"; payload_version: 1,
payload: b"payload-v1".to_vec(),
let db = db::create_test_pool().await; };
let vault = bootstrapped_vault(&db).await;
let mut conn = db.get().await.unwrap(); sign_entity(&mut conn, &keyholder, &entity, ENTITY_ID).await.unwrap();
let entity = DummyEntity { let count: i64 = schema::integrity_envelope::table
payload_version: 1, .filter(schema::integrity_envelope::entity_kind.eq("dummy_entity"))
payload: b"payload-v1".to_vec(), .filter(schema::integrity_envelope::entity_id.eq(ENTITY_ID))
}; .count()
.get_result(&mut conn)
sign_entity(&mut conn, &vault, &entity, ENTITY_ID) .await
.await .unwrap();
.unwrap();
assert_eq!(count, 1, "envelope row must be created exactly once");
let count: i64 = schema::integrity_envelope::table verify_entity(&mut conn, &keyholder, &entity, ENTITY_ID).await.unwrap();
.filter(schema::integrity_envelope::entity_kind.eq("dummy_entity")) }
.filter(schema::integrity_envelope::entity_id.eq(ENTITY_ID))
.count() #[tokio::test]
.get_result(&mut conn) async fn tampered_mac_fails_verification() {
.await let db = db::create_test_pool().await;
.unwrap(); let keyholder = bootstrapped_keyholder(&db).await;
let mut conn = db.get().await.unwrap();
assert_eq!(count, 1, "envelope row must be created exactly once");
verify_entity(&mut conn, &vault, &entity, ENTITY_ID) const ENTITY_ID: &[u8] = b"entity-id-11";
.await
.unwrap(); let entity = DummyEntity {
} payload_version: 1,
payload: b"payload-v1".to_vec(),
#[tokio::test] };
async fn tampered_mac_fails_verification() {
const ENTITY_ID: &[u8] = b"entity-id-11"; sign_entity(&mut conn, &keyholder, &entity, ENTITY_ID).await.unwrap();
let db = db::create_test_pool().await; diesel::update(schema::integrity_envelope::table)
let vault = bootstrapped_vault(&db).await; .filter(schema::integrity_envelope::entity_kind.eq("dummy_entity"))
let mut conn = db.get().await.unwrap(); .filter(schema::integrity_envelope::entity_id.eq(ENTITY_ID))
.set(schema::integrity_envelope::mac.eq(vec![0u8; 32]))
let entity = DummyEntity { .execute(&mut conn)
payload_version: 1, .await
payload: b"payload-v1".to_vec(), .unwrap();
};
let err = verify_entity(&mut conn, &keyholder, &entity, ENTITY_ID)
sign_entity(&mut conn, &vault, &entity, ENTITY_ID) .await
.await .unwrap_err();
.unwrap(); assert!(matches!(err, Error::MacMismatch { .. }));
}
diesel::update(schema::integrity_envelope::table)
.filter(schema::integrity_envelope::entity_kind.eq("dummy_entity")) #[tokio::test]
.filter(schema::integrity_envelope::entity_id.eq(ENTITY_ID)) async fn changed_payload_fails_verification() {
.set(schema::integrity_envelope::mac.eq(vec![0u8; 32])) let db = db::create_test_pool().await;
.execute(&mut conn) let keyholder = bootstrapped_keyholder(&db).await;
.await let mut conn = db.get().await.unwrap();
.unwrap();
const ENTITY_ID: &[u8] = b"entity-id-21";
let err = verify_entity(&mut conn, &vault, &entity, ENTITY_ID)
.await let entity = DummyEntity {
.unwrap_err(); payload_version: 1,
assert!(matches!(err, Error::MacMismatch { .. })); payload: b"payload-v1".to_vec(),
} };
#[tokio::test] sign_entity(&mut conn, &keyholder, &entity, ENTITY_ID).await.unwrap();
async fn changed_payload_fails_verification() {
const ENTITY_ID: &[u8] = b"entity-id-21"; let tampered = DummyEntity {
payload: b"payload-v1-but-tampered".to_vec(),
let db = db::create_test_pool().await; ..entity
let vault = bootstrapped_vault(&db).await; };
let mut conn = db.get().await.unwrap();
let err = verify_entity(&mut conn, &keyholder, &tampered, ENTITY_ID)
let entity = DummyEntity { .await
payload_version: 1, .unwrap_err();
payload: b"payload-v1".to_vec(), assert!(matches!(err, Error::MacMismatch { .. }));
}; }
}
sign_entity(&mut conn, &vault, &entity, ENTITY_ID)
.await
.unwrap();
let tampered = DummyEntity {
payload: b"payload-v1-but-tampered".to_vec(),
..entity
};
let err = verify_entity(&mut conn, &vault, &tampered, ENTITY_ID)
.await
.unwrap_err();
assert!(matches!(err, Error::MacMismatch { .. }));
}
}

Some files were not shown because too many files have changed in this diff Show More